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FOREWORD 


The  work  reported  herein  was  perforfned  in  accordance  with  Air  Force 
Contract  F3361 5— 77— C— 2029  under  the  direction  of  the  Fire  Protection  Branch 
(AFWAL/POSH)  of  the  Fuels  and  Lubrication  Division,  Aero  Propulsion 
Laboratory,  Air  Force  Wright  Aeronautical  Laboratories,  Wr Ight-Patterson 
Air  Force  Base,  Ohio,  under  Project  2348,  Task  01,  Work  Unit  02,  with 
Mr  G.T.  Beery  and  Mr  T.A.  Hogan,  AFWAL/POSH,  as  Project  Engineers. 

This  report  Is  the  result  of  utilizing  ultra-violet  ( UV)  radiation 
technology  In  the  development  and  flight  testing  of  an  advanced  aircraft 
fire  detection  system. 

The  contractor  was  General  Dynamics,  Fort  Worth  Division,  Fort  Worth, 

Texas.  Mr.  R.J.  Springer,  Program  Manager,  directed  the  efforts  of 
P.H.  Lang,  W.B.  Kirk,  B.B.  Witte,  D.C.  Nelson,  and  J.  Phillips.  The 
overall  effort  was  under  the  supervision  of  Mr.  C.E.  Porcher,  Manager, 
Propulsion  and  Thermodynamics  Section.  Gravlner  Ltd./HTL  Industries, 
General  Dynamics  subcontractor,  accorrp  1  I  shed  the  design,  fabrication, 
environmental  testing  and  support  for  the  flight  test  phase  of  the  program. 
GravIner/HTL's  efforts  were  directed  by  Mr.  S.P.  Robinson  who  was  supported 
by  P.H.  Sheath  and  D.J.V.  Smith.  Sacramento  Air  Logistics  Ccnmand  (SM-ALC) 
provided  the  F— 111  aircraft  and  support  for  the  flight  test  phase  of  the 
program.  Mr  B.W.  Nichols,  SM-ALC  Engineering,  coordinated  the  flight 
testing  at  McClellan  Air  Force  Base. 

This  report  describes  the  results  of  work  conducted  during  the  period  of 
15  December  1977  to  26  October  1981. 

This  is  Volune  I  of  three  volumes.  Volune  1  describes  the  overall  work  of 
the  program  which  includes  the  results  of  the  flight  test  phase.  Volune  II 
contains  a  description  and  details  of  the  system  circuit  and  software 
design.  Volune  III  contains  a  description  and  details  of  the  Ground 
Support  Equipment  (GSE)  which  is  used  as  a  fault  diagnostic  maintenance 
tool . 
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SUMMARY 


Analysis  and  design  requirements  were  developed  for  two  systems 
identified  as  System  A  and  System  B.  System  A  included  all  the 
basic  general  design  criteria  for  use  in  the  engine/nacelle  areas 
of  high  performance  aircraft  and  included  design  features  to 
reduce  false  fire  indications  to  a  very  low  probability  and  in¬ 
creases  the  ability  to  detect  fires  to  a  value  approaching  100  per¬ 
cent.  System  B  design  criteria  is  of  simpler  design  than  System  A 
but  has  the  same  fast  response  and  high  reliability  but  with  lower 
redundancy. 

A  trade  study  was  undertaken  to  determine  the  merits  of  a  computer 
control  unit  versus  a  hard  wired  system  for  this  program.  Using 
the  analysis  and  general  requirements  criteria  eighteen  different 
control  unit  designs  were  evaluated.  This  consisted  of  twelve 
designs  for  System  A  and  six  designs  fcr  System  B.  Both  systems 
A  and  B  included  ultra-violet  (UV)  fire  detector  heads,  a  computer 
control  unit  (CCU) ,  and  a  crew  warning  unit  (CWU) .  The  following 
optimum  systems  resulted  from  the  trade  off  study: 

System  A 

Dual  115  V.A.C.  supply 

Dual  microprocessor 

Eight  U.V.  dual  photocell  detectors 

Automatic  test  facilities. 

System  B 

.  Single  115  V.A.C.  supply 
Hardwired  system 

Eight  U.V.  single  photocell  detectors 
Manual  test  facility 
No  adj  acency . 


xi 


However, in  order  to  contain  the  contract  within  the  original 
financial  limits  System  B  was  re-configured  so  that  it  could 
be  developed  as  part  of  System  A  and  chus  resulted  in  a  micro¬ 
processor  based  system  but  with  limited  redundancy  and  using 
single  channel  detection. 

On  investigation  of  possible  flight  test  programs  it  was  deter¬ 
mined  that  the  most  effective  method  of  testing  would  be  to 
install  System  A  and  System  B  on  alternate  engines  of  a  twin 
engined  aircraft  and  bring  their  outputs  to  a  simple  control  panel 
for  the  pilot's  use.  An  F-lll  was  selected  as  the  test  vehicle. 

System  A  and  System  B  were  designed  and  manufactured  to  the  environ¬ 
mental  requirements  of  the  F-lll  aircraft  with  very  minor  exceptions. 

A  ship  set  comprising  one  System  A  and  one  System  B,  each  controlling 
five  sets  of  UV  sensing  heads,  was  manufactured  and  supplied  to  the 
Air  Force  for  installation  on  the  t&st  vehicle.  It  was  identified 
that  in  order  to  obtain  maximum  information  from  the  test  program 
ground  support  equipment  was  required.  Two  such  units  were  manu¬ 
factured  in  support  of  the  flight  test  program  and  useful  additional 
data  was  obtained.  The  flight  test  program  was  successful  in  demon¬ 
strating  that  the  original  criteria  were  met  i.e.  no  false  alarms 
and  a  fully  effective  fire  detection.  The  only  problem  encountered 
was  a  spurious  fault  indication  on  power  up  of  the  aircraft  which 
has  been  remedied  during  the  test  flight  program. 

A  final  set  of  flight  worthy  equipment  was  assembled  with  changes 
that  were  incorporated  in  the  flight  test  hardware.  This  final 
set  of  equipment  was  delivered  to  the  Air  Force. 

The  objectives  of  this  program  have  been  met.  A  UV  fire  detection 
system  has  been  developed,  fabricated  and  test  flown  on  a  high  perfor¬ 
mance  aircraft.  The  system  has  a  fire  detection  reliability  and  a 
freedom  from  false  warnings  which  is  significantly  better  than  any 
existing  service  equipment.  A  high  degree  of  redundancy,  6elf 
checking  and  automatic  reconfiguration  is  built  into  the  system  pro¬ 
viding  both  a  reduction  in  pilot  work  load  and  reduction  in  unscheduled 
maintenance  actions.  The  system  is  considered  suitable  for  near-term 
service  applications. 

The  initial  cost  of  the  new  system  is  estimated  as  being  2.5  times 
present  systems  but  the  total  life  cycle  cost  as  0.4  or  less. 

A  logical  development  of  the  new  system  is  seen  to  be  the  in  the 
incorporation  of  overheat  signalling,  where  similar  reliability 
improvements  can  be  made  at  low  technical  risk. 
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1.0  INTRODUCTION 


1.1  Objectives 

The  purpose  of  this  program  was  to  develop  and  test  advanced 
ultraviolet  sensitive  fire  detection  systems  that  have  a  high 
degree  of  reliability,  maintainability,  and  flexibility.  The 
objective  was  to  design  a  system  capable  of  detecting  aircraft 
engine/nacelle  fires  within  one  second,  reducing  false  fire 
indications  to  a  value  approaching  07.,  increasing  the  detection 
of  fires  to  a  value  approaching  1007.,  providing  continuous 
assurance  of  system  operation,  and  providing  indication  that 
the  system  is  incapable  of  detecting  fire.  Additionally, 
system  size  and  weight  was  to  be  competitive  with  existing 
systems . 

1 . 2  Background 

Detection  is  the  first,  and  probably  the  single  most  important 
factor  in  the  control  of  aircraft  engine  fires.  If  a  fire  can 
be  detected  immediately  after  it  starts,  there  is  a  good  likeli¬ 
hood  that  it  can  be  'rought  under  control.  On  the  other  hand, 
if  a  fire  is  allowed  to  become  well  established  before  it  is 
detected,  the  aircraft  probably  will  sustain  severe  damage  and 
will  probably  be  lost. 

1.2.1  Continuous  Cable  -  Type  Overheat  &  Fire  Detection 

Most  current  operational  USAF  aircraft  are  equipped  with  thermally 
activated  continuous  element  (cable  type)  sensors  for  the  detection 
of  fire  and  overheat.  To  detect  a  fire  the  direct  exposure  of 
thermal  energy  to  a  sensor  is  required  and,  therefore,  the  stnsors 
are  normally  installed  adjacent  to  expected  fire  risk  components 
in  engine  installations,  which  is  generally  in  the  nacelle  cooling 
air  path.  This  makes  them  highly  vulnerable  to  physical  damage  and 
a  compromise  is  generally  made  so  that  the  element  is  mounted  in  a 
somewhat  protective  manner,  i.e.,  close  to  skin  cr  alongside 
structural  members.  The  result  is  reduced  exposure  to  the  air 
flow,  resulting  in  a  lengthened  detection  time  or  in  some  cases, 
no  detection  at  all. 

The  service  record  of  cable  type  sensors  with  USAF  aircraft  has 
not  been  good.  Recent  surveys  have  shovjn  that  337.  of  actual  fire 
incidents  the  sensors  failed  to  detect  the  fires,  i.e,,  if  an 
engine  burner-can  burns  through,  the  flame  will  not  be  detected 
until  secondary  damage  has  occurred.  By  increasing  the  sensitivity 
to  the  hazard,  the  number  of  false  warnings  increase.  The  surveys 
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indicate  that  the  frequency  of  false  alarms  is  as  high  as  607,. 

A  continual  trade-off  has  been  seen  between  adequate  sensitivity 
to  detect  hazards,  with  false  fire  warnings,  and  inadequate 
sensitivity,  with  reduced  false  warnings.  Also,  the  location 
of  the  sensors  makes  them  liable  to  physical  damage,  especially 
during  maintenance  operations.  I 

As  overheat  detectors,  the  continuous  cable  type  sensors  provide 
excellent  protection  when  installed  properly.  However,  the 
warnin';  light  in  the  aircraft  cockpit  does  not  differentiate 
between  an  overheat  condition  and  a  fire  condition.  On  some 
aircraft,  these  sensors  are  used  to  detect  failures  of  engine 
bleed  air  ducts  in  critical  areas  but  they  have  experienced 
limited  success  due  to  the  restriction  of  providing  full  cover¬ 
age  around  a  duct . 

1.2.2  Ultra-Violet  (UV)  Tire  Detection 

Ultra-violet  measurements  of  solar  energy  and  fires  over  the 
wavelengths  200  to  320  nanometers  (nm)  have  shown  that  wave¬ 
lengths  exist  below  280  nm,  where  the  energy  from  a  fire  is 
greater  than  that  from  the  sun.  This  is  because  the  energy 
from  the  sun  is  filtered  by  the  earth’s  atmosphere. 

This  technology  has  lead  to  the  development  of  a  fire  detector 
for  aircraft  use  that  exploits  this  phenomenon,  thus  producing 
a  IV  detector  that  can  detect  fires  in  the  presence  of  sunlight 
and  yet  not  resoond  in  any  way  to  the  sunlight. 

Figure  i-1  shows  the  relative  response  of  the  HTL/Graviner  UV 
detecto'.  cell  in  conjunction  with  the  emission  of  fire  and 
sunlight.  The  peak  sensitivity  at  220  nm  is  typically  more 
than  30  million  times  greater  than  the  sensitivity  at  290  nm. 

This  v=  ry  large  difference  in  sensitivity  is  important  because 
the  amount  of  short-wavelength  power  radiated  by  a  flame  is 
only  a  small  proportion  of  the  total  power  radiated  by  the  flame 
and  is  also  small  compared  with  the  power  of  other  longer-wave- 
length  signals  found  in  the  aircraft  environment  and  to  which 
the  sensor  must  not  respond.  The  ability  of  the  UV  sensor  to 
discriminate  between  a  real  fire  and  background  radiation  depends 
principally  on  the  use  of  a  sensor  which  is  very  responsive  to 
radiation  of  200-240  nm  wavelengths  and  relatively  insensitive 
to  radiation  of  longer  wavelengths. 

The  HTL/Graviner  UV  sensor  is  essentially  a  boroBilicate  glass 
envelope  containing  metal  electrodes  and  a  low-pressure  gas 
filling. 
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In  operation,  320V  D,C.  is  connected  across  the  two  sensor 
electrodes  and  incident  photons  of  sufficient  energy  cause 
the  emission  of  an  electron  from  the  negatively  charged 
electrode.  If  the  electron  is  not  re-trapped  in  the  cathode, 
it  will  accelerate  in  the  electric  field  and  gain  sufficient 
energy  to  cause  ionization  of  a  gas  molecule.  The  electron 
released  can  cause  further  ionization  while  the  positive  ion 
returns  to  the  cathode  with  a  chance  of  causing  secondary 
electron  emission  on  collision,  When  the  secondary  electron 
emission  exceeds  the  primary  electron  emission,  the  condition 
is  right  for  breakdown  of  the  gas  and  the  tube  conducts. 

Signal  amplification  is  approximately  10^2. 

The  circuitry  of  an  associated  signal  processor  is  arranged 
to  switch  off  the  tube  when  breakdown  occurs  and  then  re¬ 
establish  the  electrode  voltage  to  await  the  next  arrival  of 
photons  with  sufficient  energy.  Each  time  breakdown  occurs, 
the  signal  processor  registers  one  count  and  if  the  count 
rate  exceeds  predetermined  conditions,  an  alarm  signal  is 
indicated. 

However,  certain  'noise'  signals  such  as  lightening,  cosmic 
and  solar  radiation  at  altitude  may  also  cause  the  sensor  to 
conduct . 

In  order  to  differentiate  genuine  fires  from  the  ’noise’ signals , 
control  circuits  are  arranged  so  that  not  just  one  but  several 
counts  are  required  in  a  pre- determined  time  period  to  initiate 
an  alarm  sequence.  The  time  period  is  selected  so  that  there 
is  a  high  probability  of  warning  from  flams  radiation  but  a  very 
low  probability  of  warning  from  any  background  radiation. 

The  detector  sensitivity,  as  noted  above,  is  described  in  terms 
of  counts  per  time  period,  since  the  system  counts  each  time 
photons  of  sufficient  energy  arrive  at  the  sensor.  Since  the 
counts  produced  arrive  in  a  poisson  distributed  manner,  the 
sensor  can  not  be  described  as  being  responsive  or  not  responsive 
to  a  particular  incident  power,  but  rather  as  having  a  definable 
probability  of  responding  to  a  particular  incident  power. 

Thus,  if  a  particular  time  period  (or  gate)  is  selected  and 
logic  circuits  arranged  so  that  a  signal  is  produced  only  when 
N  or  more  counts  occur  within  that  period,  then  the  probability 
of  responding  to  a  flame  or  solar  radiation  can  be  determined. 

In  this  case,  for  example,  a  167  msec  gate  time  and  logic  cir¬ 
cuits  that  demand  4  counts  or  more  within  the  gate  will  show  a 
probability  of  .9992  of  responding  to  the  MIL-D-27729A  pan  fire 
at  4  feet  and  a  probability  of  0.000057  of  responding  to  worst- 
case  solar  radiation. 
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It  should  be  noted  here  that  MIL-D-27729A  specifies  the  fire 
to  which  a  UV  detection  system  must  respond.  The  fire  is  set 
to  bum  in  a  5  inch  diameter  container  (pan)  and  must  be  detected 
at  a  minimum  of  4  feet  away. 

Signal/noise  enhancement  techniques  have  also  been  employed  in 
the  system  because  with  a  gate  time  of  0.167  seconds,  high  energy 
short  duration  lightning  flashes  will  fill  a  gate. 

In  the  case  of  System  B,  three  such  gates  consecutively  filled 
in  one  second  are  needed  to  generate  a  fire  warning. 

In  the  case  of  System  A,  six  consecutive  gates  are  required; 

30  on  channel  A  and  3  on  channel  B. 

Now  for  System  A,  the  possibility  of  detection  is  decreased 
slightly  to  0.995  whereas  the  possibility  of  alarms  due  to 
worst-case  solar  radiation  is  3.5  x  10*26 

The  general  aim  in  selection  of  gate  times,  counts/gate,  and 
number  of  gates  is  to  achieve  a  high  probability  of  warning 
to  flame  radiation  but  a  very  low  probability  of  warning  to 
unwanted  signals,  taking  into  account  the  required  response 
time  of  the  system.  As  has  been  implied  previously,  'response 
time'  does  not  have  the  same  meaning  in  the  probability  situation 
as  in  conventional  level-sensing  fire  detection  systems.  For 
example,  taking  the  case  of  System  A  with  a  signal  strength  less 
than  the  pan  fire,  of  40  counts/ second  average,  an  apparently 
low  probability  of  0.531  is  shown  for  response  to  the  pan 
fire  in  1  second.  In  fact,  this  probability  of  responding 
increases  sharply  for  each  incremental  addition  of  a  gate  time 
so  that  by  2  seconds  the  probability  is  0.85,  by  3  seconds 
i.he  probability  is  0.957,  and  so  on.  See  Figure  1-2. 

Figure  1-3  shows  System  A  and  System  B  probability  of  generating 
a  warning  in  one  second  with  varying  signal  strengths.  The 
signal  strength  obtained  from  the  specified  pan  fire  is  80  counts 
per  second  average. 

Further  refinements  are  included  which  increase  the  sensitivity 
of  the  system  once  a  fire  warning  has  been  signalled.  The  effect 
of  this  is  to  hold  on  the  fire  signal  under  the  test  condition 
where  half  of  the  MIL-SPEC  pan  fire  is  obscured.  In  this  held 
on  condition,  there  is  an  increased  probability  that 'the  signal 
could  also  be  held  on  by  unwanted  inputs  such  as  solar  radiation, 
but  it  can  be  readily  shown  that  this  probability  is  insignificant 
in  relation  to  the  permitted  re-set  time  of  the  system. 
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PROBABILITY  OF  ALARM  TO  40 Hz  AVERAGE  SIGNAL  STRENGTH 


RESPONSE  TIME -SECONDS 


FIGURE  1-2  RESPONSE  OF  HALF  PAN  FIRE;  40  COUNTS  PER  SECOND 


PROBABILITY  OF  ALARM  IN  1  SECOND 
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FIGURE  1-3  PROBABILITY  OF  RESPONSE  IN  1.0  SECOND 
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1 . 3  Test  Program 


The  overall  program  approach  was  to  develop  two  fire  detection 
systems,  identified  as  System  A  and  System  B.  System  A  was  iden¬ 
tified  for  use  in  the  engine/nacelle  areas  of  high  performance 
aircraft,  i.e.,  F-lll  aircraft.  Design  features  were  to'  reduce 
false  fire  indications  to  a  very  low  probability  and  to  increase 
the  ability  to  detect  fires  to  a  value  approaching  100  percent. 

The  design  criteria  was  based  on  the  concept  that  a  level  of  sub- 
syc’  ’ures  could  be  tolerated,  provided  fire  protection 

cape  is  maintained.  Above  a  certain  level  of  system  failure, 

the  pi  -Id  be  alerted  that  he  no  longer  had  an  adequate  fire 

detection  system. 

System  B  was  identified  for  use  in  less  demanding  environments  such 
as  dry  bay  areas  (equipment  bays)  and  engine  nacelle  areas  of  sub¬ 
sonic  aircraft,  i.e.,  pod-mounted  engine  bays.  Design  criteria  was 
to  be  of  simpler  design  than  System  A,  having  the  same  fast  response 
and  high  reliability  but  with  lower  redundancy. 

Both  systems  were  to  be  designed  such  that  routine  maintenance  actions 
would  allow  subsystems  that  had  failed  to  be  identified  and  reoaired 
or  replaced.  This  required  the  development  of  ground  support  equip¬ 
ment  (GSE)  to  be  used  as  a  fault  diagnostic  maintenance  tool.  The 
GSE  would  also  permit  identification  of  any  trend  towards  unservice¬ 
ability  of  the  subsystems  and  of  the  flight  performance  of  the  system. 

The  program  was  divided  into  the  following  phases : 

Phase  I  -  System  Requirements  Analysis  and  System  Specification 

Phase  II  -  Detail  Design  and  Fabrication 

Phase  III  -  Performance  and  Environmental  Tests 

Phase  IV  -  Flight  Tests  and  Evaluation 

The  system  requirements  and  analysis  (Phase  I)  was  to  establish  the 
design  configuration  of  the  systems  and  their  components.  This 
analysis  was  to  consider  the  geometry  and  environment  of  high  perfor¬ 
mance  aircraft  engine  nacelles  under  all  aircraft  operating  conditions, 
including  in-flight  and  ground,  and  to  determine  the  optimum  fire 
detecting  system  configuration. 
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Factors  to  be  considered  included  probable  fire  locations  based 
upon  combustible  fluid  sources  and  ignition  sources,  probable  fire 
paths  under  both  combat  damage  and  non-combat  conditions,  temperature 
regimes,  air  flow  patterns,  and  physical  obstructions  to  line  of 
sight  viewing.  The  analysis  was  also  to  determine  the  number  ard 
location  of  UV  detector  units  to  provide  full  coverage  of  the  nacelle 
fire  area  assuming  the  loss  or  failure  of  any  one  detector  unit . 

The  program  technical  approach  involved  the  use  of  Graviner's  high 
reliable  and  flight  qualified  UV  detector  tubes,  the  design  and 
fabrication  of  the  computer  control  unit  (CCU)  and  the  crew  warning 
and  monitoring  unit  (CWU)  from  established  technology.  These  three 
components  (UV  detectors,  CCU  and  CWU)  were  integrated  to  form  com¬ 
plete  fire  detection  systems  (Systems  A  and  B)  suitable  for  instal¬ 
lation  in  advanced  aircraft. 

Since  the  UV  detector  technology  was  available  and  the  design  of  the 
CWU  was  relatively  simple,  the  primary  design  and  development  effort 
was  directed  towards  the  CCU.  Two  candidate  CCU  designs  were  evaluated 
by  both  General  Dynamics  and  HTL/Graviner :  microprocessors  and  dis¬ 
crete  (hard-wire)  switching  circuitry.  Trade  studies  were  per¬ 
formed  as  a  part  of  the  Phase  I  effort  to  provide  a  comprison  of  these 
two  candidates  in  rerms  of  performance,  weight,  volume,  reliability, 
maintainability,  and  cost  so  that  a  CCU  design  approach  could  be 
selected  for  detailed  design  and  development. 

Detail  design  and  fabrication  (Phase  II)  of  Systems  A  and  B  were  to 
be  made  for  qualification  testing.  This  consisted  of  component  design, 
reliability  and  maintainability  studies,  and  preliminary  system  safety 
analysis.  Also,  a  detailed  installation  design  and  flight  test  plan 
was  made  for  an  F-lll  aircraft. 

Performance  and  environmental  qualification  tests  (Phase  III)  included 
flame  sensitivity,  exposure  to  flame,  functional  characteristics, 
response  and  reset  times,  and  exposure  to  high  and  low  temperatures, 
thermal  shock,  humidity,  altitude,  acceleration,  vibration  and  mechanical 
shock . 

Flight  tests  and  evaluation  (Phase  IV)  consisted  of  installing  systems 
A  and  B  on  an  F-lll  aircraft.  Analysis  and  evaluation  of  performance, 
reliability  and  maintainability  was  made  in  the  F-lll  operational 
environment. 
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2.0  SYSTEM  REQUIREMENTS 


2 . 1  Fire  Signal  Parameters 

2.1.1  Requirements 

The  following  parameters  have  been  used  in  calculating  the  best 

signal  to  noise  ratio  for  system  design. 

a)  Signal  strength  is  80  pulses  per  second  (pps)  from  the 
sensor  when  offered  up  to  the  specified  pan  fire. 

b)  Half  signal  strength  is  40  pps. 

c)  'AND'  logic  is  incornorated .  This  means  that  in  the 
following,  the  number  of  gates*  quoted  is,  in  fact,  the 
two  halves  of  the  'AND1  system  added.  Time  sharing  is 
incorporated. 

d)  Operate  times  up  to  1  second  only  have  been  calculated. 

Even  greater  signal  to  noise  ratios  can  be  achieved  by 
increasing  the  response  time  above  1  second. 

•  •% 

e)  The  noise  level  is  1.5  pps  and  is  equivalent  to  the 
worse  case  sensor  at  the  worst  position  on  the  earths 
surface. 

*Note :  "Gate"  is  the  length  of  time  the  sensor  is  'on  line’, and 
is  the  time  period  for  collecting  pulses,  after  which  the 
counter  is  set  to  zero. 

2.1.2  Calculations 

Tables  2-1  through  2-5  show  the  effects  of  increasing  the  gate  time 

of  the  sensor. 

The  calculations  are  based  on  a  Poisson  distribution  of  pulses 

obtained  from  the  sensor. 

2.1.3  Conclusions 

Other  effects  which  do  not  show  in  the  above  tables  are: 

a)  Lightning 

It  is  thought  that  a  lightning  flash  can  exceed  100  mS 
duration.  Thus,  single  low  time  gates  can  be  excluded. 

I  I 


Preceding  Page  Blank 


TABLE  2-1 
GATE  TIKE  50  mS 


TABLE  2-2 
GATE  TIME  100  mS 


Response  time 

■Bi 

mm 

0.8 

1.0  secs 

No  of  goto* 

2 

KM 

8 

10 

1  put  so  par  POO 

99.9 

99.87 

99.0 

99.7 

99.67 

gata  p .40 

96.4 

92.8 

09. 5 

86.3 

83.1 

MTBF 

5.15S 

4.4M 

3.8H 

8. 2D 

1.2Y 

2  Pulses  par  P.80 

99.4 

97.6 

97 

P40 

82.5 

46.4 

38.3 

MTBF 

16M 

2.8. 103 

2.7. 107 

2.6.1011 

3  pulses  per  P80 

97.3 

94.6 

92 

89.5 

87.1 

floto  p40 

58 

33.7 

19.6 

11.4 

6.6 

MTBF 

4.6D 

5.104 

2.1011 

7.7. 1017 

3.1024 

t 

TABLE  2-3 
GATE  TIME  150  mS 


Rcspon  sa  time 

0.3 

No  of  gates 

2 

2  pulses  per  P80 

99.98 

M0 

96.6 

MTBF 

- 

5.3M 

3  pulses  per  P80 

99.9 

««"*  P40 

88 

MTBF 

16. 1H 

4  pulses  per  P80 

99.5 

»a,°  P40 

72 

MTBF 

218D 

99.8 

77.4 

716V 


1.2  Sacs 
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99.95  99.94 

90  86.9 

44. 1Y  9.3. 104 


99.7  99.6 
68.1  59.9 
2.8. 108  1014 


98.2 

26.9 

1.2.1024 


TABLE  2-5 

GATE  TIME  0.25  SEC 


Response  time 

No  of  gales 

7  pulses  per 

P80 

gate 

P40 

M 

8  pulses  per 

P80 

gate 

P40 

M 

9  pules  per 

P80 

gate 

P40 

M 

10  pulses 

POO 

per  gate 

P40 

M 

99.84 

60.8 


99.9 

99.85 

57.25 

43.32 

1.6.1019 

7.1032 

99.7 

99.5 

37 

22.5 

2.3. 1033 

7.1040 

99.17 

98.75 

19.8 

8.8 

o 

w 

O 

1.3.1 0^9 

98 

97 

8.6 

2.7.1035 

2*5  57 

1.6. 105' 

b)  Background  Level 


It  is  known  that  a  background  level  of  radiation  can  be 
obtained  from  such  things  as  cosmic.  Although  this 
occurs  at  a  very  low  level,  it  means  that  single-pulse 
per  gate  systems  should  not  be  used  if  possible. 

c)  Half  Signal  Strength 

In  order  to  lock  onto  a  pan  fire  at  half  intensity  once 
it  has  warned,  it  is  necessary  to  count  half  of  the 
counts  per  gate. 


d)  Half  System  Failure 

Should  half  the  'AND*  system  fail  then  the  half  system 
left  should  still  be  capable  of  generating  a  fire  warning. 
This  is  considered  in  the  final  conclusion,  to  give  a 
good  noise  immunity. 


2.1.4  Final  System  Design 

Response  Time 
Gate  Time 
Pulses  per  gate 
No.  of  gates/system 
.‘.No.  of  gates/sensor 


1  second 
0.167  seconds 
4 
6 
3 


Probability  of  detecting  the  specified  pan  fire  in  1  second  is  99.5*4, 

m  2  A 

Probability  of  a  false  warning  due  to  solar  is  5.6  X  10 
+14 

or  1  per  9.4  X  10  years. 


Thus,  the  system  should  be  designed  such  that  after  a  fire  warning 
has  been  given  the  warning  will  be  maintained  at  2  pulses  per  gate. 


Hence,  the  probability  of  maintaining  a  fire  warning: 
a)  With  full  pan  fire  is  99.99*4 


b)  With  half  pan  fire  is  94.3*4 


It  should  be  noted  that  the  probability  of  sensing  a  half  pan  fire 
is  52.87,  in  the  specified  time  of  1  second. 

It  should  be  noted  that  in  times  above  1  second,  the  probability  of 
detecting  the  pan  fire  increased  towards  100*4. 
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If  Che  system  is  now  run  on  half  of  the  'AND',  logic  to  give  a  fire 
alarm,  the  false  warning  rate  from  solar  is  decreased  from  1  per 
9.4  X  10l4  years  to  1  per  1.3  X  10^*  years. 

2.1.5  Tolerance  Effects 

The  design  is  based  upon  nominal  signal  strengths  fron  the  U.V. 
detector  when  viewing  a  5  inch  pan  fire. 

Figure  2-1  shows  the  effect  of  worse  case  U.V.  detector  parameters 
upon  the  response  of  the  system. 

The  probability  theory  can  be  applied  to  the  electronics  assuming 
the  signal  strength  from  the  U.V.  detector  varies.  This  produces 
the  curve  of  signal  strength,  versus  probability  of  detection  within 
1  second  (Note:  If  the  time  is  increased,  the  probability  increases, 
therefore,  the  fire  will  always  be  detected  if  the  time  is  long 
enough).  From  the  curve  at  20  pulses  per  second,  there  is  still  a 
probability  of  0.67,.  Therefore,  fires  can  be  detected  smaller  than 
the  5"  pan  fire  in  1  second,  but  with  a  low  probability. 

The  worst  case  limits  for  the  U.V.  detector  include  all  specification 
variations . 

2.1.6  Effects  of  Lightning  on  U.V.  Equipment 

The  effects  of  lightning  arc  based  on  reported  observations  and 
those  of  K.  Berger  who  observed  lightning  on  Mt .  San-  Salvadore  in 
Switzerland  (Reference  2-1).  He  found  that  lightning  existed  from 
0.5  to  1.5  seconds  with  a  small  number  of  occurrences  longer  than 
1.0  second.  Based  on  the  analysis  of  this  data  it  was  concluded 
that  the  response  time  should  remain  at  1  second  with  0.167  gate 
t imes . 

2 . 2  Other  Considerations 

This  analysis  is  required  to  consider  the  geometry  and  environment 
of  high  performance  aircraft  engine  nacelles  under  all  aircraft 
operating  conditions,  including  in  flight  and  ground,  to  determine 
the  optimum  fire  detecting  system  configuration.  In  doing  this,  it 
is  required  to  consider  in  particular  the  F-lll  aircraft  and  other 
high  performance  aircraft  and  conceptual  designs  through  the  1992 
time  period,  to  provide  a  basic  broad  application  of  the  detector 
system. 
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2.2.1  General  Considerations 


In  deciding  the  number  and  position  of  the  detectors  required  for 
the  most  effective  fire  protection  within  the  engine  nacelle  of  a 
high  performance  aircraft,  the  following  points  must  be  .considered. 

a)  The  detector  will  have  a  direct  view  of  the  locations 
of  all  likely  fire  hazards. 

b)  The  detector  should  be  accessible  to  permit  cleaning. 

c)  The  detectors  will  be  positioned  so  that  there  is  no 
direct  viewing  of  light  sources  external  to  the  engine 
nacelle,  (such  as  afterburner  plumes). 

d)  The  detectors  should  be  located  where  damage  is  unlikely 
during  engine  removal  or  maintenance . 

e)  The  detector  will  not  be  located  close  to  hot  exhausts 
in  excess  of  250°C. 

f)  The  detector  should  be  situated  facing  "down  wind”  to 
minimize  the  contamination  accumulation  on  the  optical 
surfaces  . 

g)  Any  one  location  of  a  possible  fire  hazard  will  be  covered 
by  viewing  area  of  at  least  two  detector  units,  so  that 
the  system  may  operate  satisfactorily  with  the  loss  or 
failure  of  any  one  detector  unit. 

When  locating  a  detector  for  a  particular  aoplication,  it  is  not 
always  possible  to  comply  with  all  the  above  considerations,  and 
the  best  compromise  must  be  reached. 

2 . 3  System  Design  Criteria 

The  basic  criteria  for  the  system  design  is  developed  from  the  require¬ 
ments  in  the  Statement  of  Work.  The  criteria  laid  down  in  the  State¬ 
ment  of  Work  can  be  restated  as  "The  ideal  fire  and  detection  system 
would  reliably  detect  every  incident  that  arises,  would  not  itself 
cause  any  operational  problems  and  would  also  have  zero  weight  and 
zero  life  cycle  cost!" 

The  aim  in  fitting  a  fire  detection  system  is  of  course  to  reduce  the 
total  hazard  to  which  an  aircraft  is  exposed,  The  degree  of  success 
in  achieving  this  aim  is  not  just  a  function  of  the  fire  detection 
system  itself,  but  also  of  the  installation  on  the  aircraft  and  the 
effectiveness  of  the  fire  drills, 

I  9 


Figure  2-2  is  a  representation  of  the  total  fire  related  hazard 
situation  when  a  fire  detection  system  is  fitted.  The  precise 
levels  of  severity  of  hazard  are  arguable,  but  it  is  reasonable 
to  suppose  that  a  detected  fire  is  considerably  less  hazardous 
than  an  undetected  fire,  and  chat  a  false  warning  is  less  hazardous 
than  a  detected  fire  because  presumably  no  other  engine  fault  exists. 

Area  'a'  represents  failure  to  detect  a  fire,  while  area  'c'  repre¬ 
sents  an  additional  hazard  introduced  as  a  consequence  of  fitting 
the  detection  system.  In  order  to  achieve  maximum  hazard  reduction 
it  is  aimed  to  reduce  areas  'a'  and  'c*  to  as  close  to  zero  as 
possible,  this  gives  rise  to  the  normal  definition  of  system  reli¬ 
ability  which  states  that  a  system  should  have  a  hiph  probability 
of  signalling  when  a  fire  hazard  exists  and  a  low  probability  of 
falsely  signalling  a  fire  when  the  hazard  is  absent. 

This  is  a  reasonable  first  definition  although  it  does  not  take 
account  of  the  relative  importance  of  the  two  factors,  in  particular 
of  the  enormous  cost  of  failing  to  detect  a  fire. 

2.3.1  Fire  Detection  System  Requirements 

As  noted  previously,  a  high  reliability  fire  detection  system  should 
have  a  high  probability  of  detecting  a  hazard  and  a  low  probability 
of  false  warning.  In  addition,  it  is  desirable  that  the  greater 
emphasis  is  placed  on  detection  capability. 

In  order  to  meet  this  aim,  the  important  performance  characteristics 
that  should  be  sought  in  a  continuous  cable  type  fire  detection 
system  are  as  follows: 

a)  The  system  should  be  as  sensitive  as  possible  to  fire 
conditions . 

b)  The  system  should  have  an  extremely  low  probability  of 
failing  in  such  a  manner  that  it  is  unable  to  detect  a 
fire. 

c)  The  system  should  be  free  from  false  warnings . 

2. 3. 1.1  System  A  Design  Criteria 

From  the  above  it  will  become  clear  that  the  primary  goal  of  svstem 
A  design  requirements  should  be: 


Number  of  Incident* 


FIGURE  2-2  FIRE  RELATED  HAZARD  POTENTIAL 


a)  That  in  the  event  of  partial  systems  failure  or  total 

failure  of  one  or  more  detector  units,  the  system  shall 
not  false  warn,  shall  not  alert  the  pilot,  shall  continue 
to  operate  as  a  fire  detection  system.  It  will  be  seen 
that  in  this  situation  some  means  of  system  interrogation 
must  be  made  available  as  otherwise  failures  of  sub- systems 
would  build  up  to  a  point  where  total  systems  failure  would 
occur . 


b)  The  system  A  configuration  was,  therefore,  based  on  a  con¬ 
cept  that  a  level  of  systems  failures  could  be  tolerated 
providing  fire  orotection  capability  was  maintained.  Above 
a  certain  level  of  system  failure,  the  pilot  would  be 
alerted  that  he  no  longer  had  an  adequate  fire  detection 
system,  but  prior  to  that  level  being  achieved,  routine 
maintenance  actions  would  allow  subsystems  that  had  failed 
to  be  identified  and  repaired  or  replaced.  Thus,  effec¬ 
tively  the  availability  of  the  system  for  fire  detection 
would  become  independent  of  the  mean  time  between  failure 
of  the  system  components,  i.e.  a  redundant  system. 


2 . 3 . 1 . 2  System  B  Design  Criteria 


The  Statement  of  Work  defined  system  B  as  being  a  lower  environmental 
requirement  system  and  a  fundamentally  simpler  system.  Review  of  the 
specifications  of  the  hardware  to  be  incorporated  on  system  6,  indi¬ 
cated  that  reduction  in  environmental  requirements  would  have  no  bear¬ 
ing  on  simplification  of  the  design.  System  B  has,  therefore,  been 
considered  to  work  at  the  same  environmental  levels  as  system  A  and 
it  is,  therefore,  suitable  for  fitting  to  military  aircraft  in  engine 
nacelles.  The  reduction  in  complexity  of  system  B  was  brought  about 
by  the  removal  of  the  requirement  for  self-checking  features  on  an 
automatic  basis,  and  the  removal  of  the  requirements  for  redundancy. 
The  requirements  for  manually  initiated  self-test  was  left  in  the 
system  design,  however,  and  review  of  this  facility  as  part  of  the 
trade  study  indicates  that  the  implications  of  removing  this  feature 
need  further  discussion. 


2.3.2  Passive  Versus  Active  Failure  Modes 

The  majority  of  continuous  fire  detection  systems  currently  being 
flown  on  U.S.  military  aircraft  are  of  such  a  design  that  in  the 
event  of  a  failure  the  system  fails  'active',  thus,  causing  a  false 
warning  condition.  The  result  of  this  failure  mode  is  of  course 
that  the  false  warning  is  investigated  at  the  end  of  the  mission,  and 
rectification  is  put  in  hand.  Since  rectification  is  therefore  carried 


out  in  the  event  of  a  failure  (when  systems  fail  active)  systems 
that  fail  in  this  manner  do  remain  effective  as  fire  detection 
systems  throughout  the  life  of  the  aircraft.  Note:  The  same 
cannot  be  said  for  systems  which  fail  in  a  passive  mode  and  which 
are  not  capable  of  being  checked  in  a  fully  "end  to  end",  manner. 

The  U.V.  flame  detector  system  is  primarily  a  passive  failure  mode 
system,  in  that  the  most  likely  failure  modes  are  contamination  of 
the  tube  surface,  wires  breaking  or  beinp  shorted  together.  All 
these  failure  modes  will,  in  fact,  result  in  passive  failure,  in 
that  they  will  not  cause  the  control  unit  to  signal  a  fire.  Thus, 
without  any  comprehensive  systems  testing  the  resultant  situation 
would  be  that  large  number  of  fire  detection  systems,  while 
originally  perfectly  satisfactory,  would  over  a  period  of  time, 
and  a  number  of  missions,  become  non-effective,  and  thus,  the 
aircraft  would  be  flying  without  viable  fire  detection  systems  on 
board.  Note:  Again  a  parallel  can  be  drawn  with  certain  continuous 
detector  systems  currently  flying  on  American  military  aircraft.  It 
is  thus ,  considered  to  be  essential  that  for  a  system  such  as  this, 
some  fully  comprehensive  test  system  be  incorporated  which  can  be 
initiated  by  ground  crew  or  pilot  prior  to  mission.  The  system 
proposed  is  that  a  U.V.  emitter  be  mounted  external  to  the  envelope 
of  the  detector  tube,  and  be  energized  (on  system  B)  by  manual  action 
prior  to  mission.  The  system  will  then  signal  a  fire  warning  which 
will  confirm  that  the  system  is  operational,  right  from  the  detector 
through  to  the  crew  warning  unit.  It  was  not  considered  adequate  to 
simply  electronically  check  the  control  unit  and  the  wire  going  to 
the  detector  units.  Note:  Comparison  can  be  drawn  with  current 
continuous  detector  system  flying  on  American  military  aircraft. 

Unfortunately,  the  Trade  Study  does  not  allow  detailed  analysis  of 
the  passive  failures  over  multi  mission  activities,  simply  because 
not  enough  information  is  available  on  the  mission  profile  of  the 
aircraft  involved.  Thus,  comprehensive  self-test  systems  invariably 
resulted  in  an  apparently  less  optimal  system  design.  However, 
because  of  the  arguments  given  above,  this  element  of  the  Trade 
Study  was  ignored. 
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3.0  TRADE  STUDIES  AND  PREFERRED  SYSTEM  DESIGN  SELECTION 


3 . 1  Trade  Studies 

Since  the  U.V.  detector  technology  was  available  through  Graviner's 
extensive  experience  the  main  effort  was  to  develop  the  Computer 
Control  Unit  (CCU)  logic  circuits  and  hardware.  This  trade  study 
was  to  ensure  that  the  proven  high  reliability  was  maintained  with 
the  requirements  of  response  time,  fire  warning/ fault  warning  logic 
and  automatic  self  test.  The  trade  study  was  undertaken  to  deter¬ 
mine  the  merits  of  a  computer  control  unit  versus  a  hard  wired  system. 

In  order  to  achieve  a  design  with  the  maximum  impact  on  life  cycle 
costs  and  effectiveness,  eighteen  serparate  designs  were  analyzed; 
twelve  for  System  A  and  six  for  System  B. 

3.1.1  System  A 

System  1  was  chosen  as  the  initial  A  system  and  the  remaining  A 
svstems  were  compared  with  it. 

System  1,  Dual  28V  Supply  With  2  Microprocessors 

The  system  has  two  internal  28V  D.C.  power  supplies  supplying  two 
microprocessor  based  control  electronics.  Using  this  system,  should 
either  a  power  supply  or  a  microprocessor  fail,  the  system  still 
functions  as  a  fire  detector,  as  the  remaining  power  supply  and 
microprocessor  still  function  correctly. 

System  2,  Dual  28V  Supply  With  Hardwire 

System  2  is  identical  in  performance  to  system  1,  but  has  a  hardwire 
electronic  control  instead  of  two  microprocessors . 

System  3.  Single  28V  Supply  With  1  Microprocessor 

This  system  has  all  the  capabilities  of  an  A  system,  but  should 
either  the  internal  28V  D.C.  supply  or  the  microprocessor  fail, 
the  system  fails. 

System  4.  Single  28V  D.C,  Supolv  TJith  Hardwire  Circuit 

Single  4  is  as  system  3  except  the  single  microprocessor  has  been 
substituted  by  hardwire  circuitry. 
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System  5,  Dual  115V  A.C.  Supply  With  2  Microprocessors 


This  system  is  as  system  1  except  it  utilizes  two  115V  D.C.  supplies 
instead  of  two  28V  D.C.  supplies. 

Sys tern  6 .  Dual  115V  A.C.  Supply  With  Hardwire  Circuit 

System  6  is  as  system  5  except  that  the  two  microprocessors  have 
been  replaced  by  an  equivalent  hardwire  circuit. 

System  7.  Single  115V  A.C.  Supply  With  1  Microprocessor 

System  7  is  the  equivalent  of  system  3  except  the  115V  supply 
replaces  the  28V  D.C.  supply. 

System  8.  Single  115V  A.C.  Supply  With  Hardwire  Circuit 

This  system  is  identical  in  operation  to  system  7  but  uses  hardwire 
circuits  instead  of  a  microprocessor. 

Sys  tern  9 .  Single  115V  A.C.  Supply  With  2  Microprocessors 

Utilizing  this  system  enables  one  microprocessor  to  fail  and  the 
system  still  functions  as  a  fire  detector.  However,  should  the 
internal  power  supply  fail,  the  system  fails. 

System  10.  Single  28V  D.C.  Supply  With  2  Microprocessors 

System  10  is  as  system  9  except  that  the  1  !5V  A.C.  supply  has  been 
replaced  with  a  28V  D.C.  supply. 

System  11.  Dual  28V  D.C,  Supply  VJith  1  Microprocessor 

In  this  system  should  one  power  supply  fail  the  system  still 
functions  correctly  using  the  second  supply.  However,  should 
the  microprocessor  fail,  the  system  fails. 

System  12.  Dual  115V  A,C.  Supply  With  1  Microprocessor 

This  system  is  the  equivalent  of  system  11  except  the  28V  D.C. 
supplies  have  been  replaced  with  115V  A.C.  supplies. 

3.1.2  System  B 

All  B  systems  have  r .ual  test  facility.  System  13  was  chosen 
as  the  initial  B  system  and  the  remaining  B  systems  were  compared 
with  it. 
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System  13.  Single  28V  D.C.  Supply,  Hardwire  Circuitry 
No  Adjacency 

As  stated  this  system  is  a  single  28V  D.C.  supplied  unit,  with 
hardwired  circuitry.  In  the  A  systems  above  there  is  adjacency 
cf  U.V.  detectors.  That  is,  each  fire  risk  area  is  viewed  by 
two  U.V.  detectors  and  both  must  respond  to  enable  a  fire  warning 
to  be  indicated.  This  system  has  no  adjacency.  That  is.  although 
the  fire  risk  area  is  viewed  by  two  U.V.  detectors,  only  one 
responding  gives  a  fire  warning  indication. 

System  14,  Single  115V  A.C.  Supply,  Hardwire.  No  Adjacency 

System  14  is  the  equivalent  of  system  13,  only  using  a  115V  A.C. 
supply  instead  of  a  28V  D.C.  supply. 

System  15.  Single  28V  D.C.  Supply,  1  Microprocessor,  No  Adjacency 

This  system  is  the  equivalent  of  system  13  except  the  hardwire 
circuit  has  been  replaced  with  a  single  microprocessor  circuit. 

System  16.  Single  28V  D.C.  Supply.  1  Microprocessor,  With  Adjacency 

Identical  to  system  15,  this  system  has  adjacency  as  an  included 
extra. 

System  17.  Single  115V  A.C.  Supply,  1  Microprocessor,  No  Adjacency 

System  17  functions  as  per  system  15,  except  the  28V  D.C.  supply 
has  been  replaced  by  a  115V  A.C.  supply. 

System  18,  Single  115V  A.C.  Supply,  1  Microprocessor,  With  Adjacency 

This  system  is  equivalent  to  system  16,  except  the  115V  A.C.  supply 
replaces  the  28V  D.C.  supply. 

3.1.3  Def ign  Approach 

All  the  eighteen  systems  described  above  were  dissected  into  several 
major  design  areas. 

For  the  A  systems  they  were: 

Dual  Photocell  U. V .  Detectors 


28V  D.C.  Power  Supply 

Includes  stabilization  of  the  input  voltage,  high  voltage  inverter 
and  EMC  components 
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115V  A.C.  Power  Supply 

Stabilization  of  the  input  voltage  and  EMC  components  included. 

U.V.  Detector  Drive  Circuitry 

Isolation  of  the  high  voltage  U.V.  detector  drive  circuitry  enables 
the  effects  of  increasing  the  number  of  detectors  to  be  examined. 

Automatic  Test  Circuitry 

Single  Microprocessor  Approach 

This  refers  to  the  main  signal  processing  and  output  control 
circuitry . 

Dual  Microprocessor  Approach 

Hardwire  Version  of  Single  Microprocessor  Approach 

Hardwire  Version  of  Dual  Microprocessor  Approach 

This  refers  to  the  main  signal  processing,  and  output  control 
circuitry . 

For  the  B  systems  the  dissected  areas  are: 

Single  Photocell  U.V.  Detectors 
This  unit  included  a  test  emitter. 

Power  Supplies 

The  power  supplies  were  identical  to  those  for  System  A  abcv.j. 

U.V.  Detector  Drive  Circuitry 

Again  this  circuitry  was  as  the  A  system. 

Single  Microprocessor  Approach 
Hardwire  Approach 

These  latter  twc  areas  refer  to  the  signal  processing  and  output 
control  circuitry. 
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Adjacency  Cii-cuitrv 


In  order  to  ascertain  the  effects  of  adjacency  on  the  B  system, 
the  adjacency  circuitry  was  separated, 

3.1.4  Design  Comparison 

The  concept  of  the  Trade  Study  was  to  evaluate  the  benefit  of  a 
particular  type  of  fire  detection  system,  and  offset  these  benefits 
against  the  cost  of  that  type  of  system.  Within  the  benefits  and  the 
cost  sides  of  the  equation  that  were  thus  generated  there  were  obviously 
some  sub-divisions  each  with  their  own  relative  merit.  Thus,  a  weight¬ 
ing  system  for  the  various  features  of  an  individual  fire  detection 
system  had  to  be  quantified. 

In  order  to  compare  the  impact  of  different  designs  of  a  U.V.  advanced 
fire  detection  system  on  life  cycle  costs  and  effectiveness,  a  Trade 
chart  (Figure  3-1)  was  derived.  Weighting  factors  were  allocated 
which  show  the  order  of  importance  of  each  item.  A  high  weighting 
factor  means  a  high  importance. 

From  Figure  3-1  the  effectiveness  is  divided  into  Fire  Detection 
Ability  and  Freedom  from  False  vJarning. 

Once  the  theoretical  circuit  design  had  been  derived,  each  component 
part  was  analyzed  for  its  failure  rate,  for  both  open  and  short 
circuit  conditions. 

Freedom  from  false  warning  is  identified  as  Mean  Time  Between  False 
Warnings  (MTBFW)  and  is  obtained  from  reliability  figures  from  the 
electronic  design.  Thus,  all  components  that  go  out  of  tolerance 
and  produce  a  fire  warning  have  been  examined,  so  producing  an 
MTBFW.  These  failures  are  classified  as  Active  failures. 

As  designs  are  compared,  the  Fire  Detection  ability  is  a  function 
of  the  Passive  failure  rate  of  the  design.  That  is  all  components 
which  go  out  of  tolerance,  prevent  a  genuine  fire  from  being  indicated. 

The  life  cycle  costs  can  be  basically  divided  into  three  components; 
the  purchase  cost  of  the  system,  the  physical  parameters,  such  as 
weight  and  dimensions,  and  the  Mean  Time  Between  Failures  (MTBF) / 
Maintenance  costs,  of  the  system. 

The  purchase  cost  for  comparison  purposes  are  obtained  in  arbitrary 
units  for  each  design.  The  method  was  constant  for  each  design. 

The  physical  parameters  were  divided  into  tvo ;  size  and  weight.  Again 
the  figures  are  arbitrary  units,  with  the  method  constant  in  each 
design. 
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The  MTBF/Maintenance  costs  can  be  further  divided.  However,  in 
order  to  carry  out  the  study,  the  MTBF  function  only  was  considered, 
as  it  was  thought  that  this  item  was  the  major  influence.  Thus, 
parts  of  the  system  going  out  of  tolerance,  producing  system  failures, 
are  summed  to  produce  a  reliability  figure  and  hence  the  MTBF. 

With  regard  to  values  of  weighting  factors,  it  is  suggested  that 
the  benefits  should  balance  the  other  parameters,  and  therefore, 
if  we  use  a  scale  of  10,  benefits  should  equal  10.  Life  cycle 
costs  should  equal  10. 

The  breakdown  of  benefits  is  fairly  straight  forward.  It  can  be 
argued  that  the  system  is  not  effective  as  a  fire  detector  if  an 
indication  from  it  does  not  indicate  with  a  degree  of  certainty 
that  there  is  a  fire  (as  opposed  to  false  warning) .  Looking  at 
the  situation  from  the  pilots  point  of  view,  therefore,  it  can  be 
argued  that  if,  when  the  red  light  comes  on  there  is  less  than  a 
50:50  chance  of  the  red  light  indicating  that  a  fire  exists,  the 
value  of  the  red  light  is  non-existent,  and  therefore,  the  equip¬ 
ment  is  not  effective.  Thus,  the  ability  to  detect  fires  should 
be  equated  equally  to  the  lack  of  false  warnings.  (This  is  entirely 
in  agreement  with  the  requirement  that  the  false  warning  rate 
should  approach  zero,  since  the  frequency  of  real  fire  warnings 
will  be  very  low).  However,  historical  data  to  hand  indicates  that 
in  the  U.S.  Air  Force,  there  is,  in  fact,  a  false  warning  to  true 
warning  ratio  of  4:1  or  worse,  i.e.  for  every  time  the  fire  warn¬ 
ing  light  comes  on  there  is  a  4  to  1  chance  that  there  is  NOT  a 
fire. 

Now  let  ua  address  the  sub-division  of  life  cycle  cost,  it  is 
obvious  that  the  cost  of  maintenance  is  a  direct  function  of  the 
MTBF  of  the  system.  Thus,  for  the  sake  of  the  Trade  Study,  it  is 
pointless  separating  the  two  items,  and  a  single  element  KTBF  can 
be  used  for  the  purpose  of  the  study.  However,  since  this  is  a 
relatively  important  item,  and  since  it  is  a  prime  driver  in  terms 
of  the  cost  of  ownership  of  the  system,  it  weighting  factors  should 
be  high. 

The  question  of  ground  support  equipment  and  its  impact  on  cost  of 
ownership,  was  also  addressed,  however,  since  the  distribution  of 
aircraft  using  the  system  is  indeterminate,  it  is  not  possible  to 
quantify  this  as  an  item,  and  since  the  overall  impact  on  the  cost 
of  ownership  is  considered  to  be  low,  this  item  was  not  included  in 
the  Trade  Study. 
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The  physical  make  up  of  the  equipment  is  partly  weight  and  partly 
size.  The  impact  on  life  cycle  cost  of  these  two  parameters  is 
considered  to  be  relatively  small,  providing  that  the  system  size 
and  weight  is  within  the  general  requirements  of  the  aircraft. 
However,  since  some  of  the  options  that  were  investigated  have  a 
marked  impact  on  size  and  weight,  the  figure  of  0.8  for  weight 
and  0.2  for  size  was  left  in  the  Trade  Study.  Finally,  initial 
system  cost  obviously  has  a  bearing  on  the  choice  of  a  system, 
and  although  it  is  considered  to  be  a  relatively  small  component 
of  the  overall  life  cycle  costs,  the  initial  funding  problems  it 
generates  suggested  a  value  of  3  should  be  used. 

The  resulting  equation,  therefore,  becomes: 

U  x  (Benefits)  -  (Life  Cycle  Costs)  »  Value. 

W  x  (8  x  FD  +  2  x  FW)-(3  x  C  +  0 . 8  x  W  +  0 . 2  x  S  +  6  x  MTBF)  -  V. 
where 

U  *  Utilization  factor. 

FD  -  Failure  to  detect  a  fire  -  passive  failure. 

FW  »  False  warning  -  active  failure. 

C  »  Cost. 

W  ■  Weight . 

S  ■  Size. 

MTBF  •  Mean  time  between  failures  (See  Note  1) . 

V  ■  Arbitrary  value  of  system  (See  Note  2) . 

Note  1 


It  la  recognized  that  the  meantime  between  failures  will  appear  as 
part  of  FD  -  Failure  to  detect,  and  FW-  False  warning.  However,  in 
redundant  systems  assuming  a  standard  service  period,  the  three  func¬ 
tions  are  not  directly  related.  Since  MTBF  results  in  removal  costs 
and  replacement  costs,  the  place  for  MTBF  was  on  the  cost  side  of 
the  equation,  while  the  indirectly  related  failure  modes  are  shown 
on  the  benefits  side  of  the  equation, 
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Note  2 


The  arbitrary  value  resulting  from  this  equation  is  not  in  itself 
a  measure  of  the  value  of  a  fire  detection  system  on  the  aircraft. 
However,  it  is  of  value  when  comparing  systems  having  basically 
the  same  function,  thus  allowing  comparison  of  design  methods  to 
be  made. 

It  is  recognized  that  the  elements  in  the  life  cycle  cost  bracket, 
are  not  all  in  the  same  units.  Nor  are  they  necessarily  correct 
in  terms  of  real  world  values  on  the  life  cycle  of  the  equipment, 
and  thus,  a  variety  of  calculations  were  carried  out  on  the 
"winning"  systems  to  measure  the  sensitivity  of  the  design  Trade 
Off  Study  to  the  actual  values  used.  It  was  found,  as  a  result  of 
these  calculations,  that  the  sensitivity  to  the  values  was  very 
low.  The  driving  factors  were  definitely  in  the  benefits  area,  and 
because  of  the  functional  linking  between  the  passive  failure  and 
the  active  failure  modes,  even  dramatic  changes  in  the  ratio  of 
these  particular  benefits  did  not  effect  the  outcome  of  the  Trade 
Study.  Similarly,  the  value  applied  for  utilization  factor  of 
the  aircraft,  had  little  bearing  on  the  result  of  the  analysis. 

It  is,  therefore,  believed  that  the  resulting  analysis  is  valid  for 
almost  any  aircraft  in  almost  any  operational  mode.  This,  of  course, 
means  that  a  degree  of  standardization  on  aircraft  can  be  achieved. 

The  assumption  made  in  Note  1  indicates  the  need  for  a)  a  regular 
maintenance  period,  and  b)  ground  support  equipment.  It  would  only 
be  fair  to  put  the  cost  of  the  ground  support  equipment  in  the  life 
cycle  costs  area.  However,  it  is  difficult  to  quantify  these  costs 
without  an  understanding  of  the  logistics  of  supporting  the  aircraft 
in  use.  Thus,  for  the  sake  of  this  calculation,  the  element  has 
been  left.  It  is  believed  that  this  will  not  dramatically  effect 
the  results  of  the  study. 

As  the  trade  off  study  is  by  comparison,  Figure  3-1  can  be  broken 
down  into  specific  items  which  can  be  calculated  from  the  design. 
From  the  breakdown  a  Figure  of  Merit  can  be  obtained.  The  Figure 
of  Merit  for  each  design  can  be  compared,  so  that  the  highest 
indicates  the  design  with  the  superior  performance. 

It  should  be  noted  that  parameters  such  as  aircraft  wiring,  immunity 
to  lightning  sooting  etc,  are  all  assumed  constant  for  each  design 
and  as  such  have  no  effect  in  the  comparison  process. 

The  results  for  system  A  shown  in  Table  3-1  shows  the  parameters  of 
each  system  and  a  calculated  merit  figure  for  each  parameter  when 
compared  with  system  1. 
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In  order  to  arrive  at  a  figure  of  merit  the  following  theory  was 
used : 


Figure  of  merit  *  Maximum  Parameter  Value  1  x  Weighting 

per  parameter  Minimum  Parameter  Value  Factor 

The  figure  of  merit  is  then  positive  or  negative  according  to 
whether  the  compared  parameter  is  better  or  worse  respectively 
than  the  initial  system  parameter. 

Thus,  a  figure  of  +  2  means  that  the  compared  system  is  twice  as  good 
as  the  initial  system.  A  negative  figure  means  vice  versa. 

From  the  total  merit  figure  system  5  is  the  better  system  with  a  value 
of  +  1.2266  when  compared  with  system  1,  as  against  all  the  remaining 
A  systems  which  are  negative. 

The  analysis  for  system  B  shown  in  Table  3-2  were  carried  out  in 
exactly  the  same  manner  as  for  system  A. 

The  results  indicate  that  system  14  is  the  better  system  as  it  has 
the  highest  figure  of  merit  at  +  6.4197. 

3 . 2  Preferred  Systems 

As  a  comparison  between  systems,  the  initial  system  A  was  compared 
with  the  initial  system  B  and  found  to  be  1022  times  better. 

System  5  was  also  compared  with  system  14  and  found  to  be  617  times 
better.  The  high  relative  merit  of  system  5  is  attributable  entirely 
to  the  high  effectiveness  in  detecting  fire,  as  opposed  to  false 
warning  or  other  factors. 

In  order  to  evaluate  the  weighting  factors  applied  to  effectiveness, 
calculations  were  carried  out  with  the  factors  to  reverse,  i.e. 

Passive  failure  2,  Active  failures  8.  The  results  obtained  did  not 
change  the  order  of  merit. 

Therefore,  from  this  Trade  Off  Study,  the  two  systems  preferred 
are  as  follows ; 

System  A 

Dual  115V  A.C.  supply 

Dual  microprocessor 

Eight  U.V.  dual  photocell  detectors 

Automatic  test  facilities. 
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TABLE  3-1 
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TABLE  3-2 

SYSTEM  B  TRADE  OFT  STUDY 


Single  115V  A.C. 

Hardwired  system 

Eight  single  photocell  detectors 

Manual  test  facility 

No  adjacency. 

3.2.1  Final  Selection  of  Systems  for  Design.  Fabrication  and  Test 

Evaluation  of  additional  factors  not  included  in  the  trade  study 
indicated  that,  since  preferred  system  A  used  microprocessors,  it 
would  be  most  advantageous  to  design  System  B  as  essentially  one 
half  of  System  A.  This  configuration  would  result  in  lower  costs 
and  still  provide  the  advantages  of  the  System  A  design.  The 
approach  allows  commonality  of  design,  components  and  provides 
a  good  baseline  for  evaluation.  The  final  selection  of  System  A 
is  as  by  the  trade  study  and  System  B  modified  the  trade  study 
results  and  is  as  follows: 

Single  115V  A.C.  supply 

Single  microprocessor 

Eight  single  U.V.  photocell  detectors 

Automatic  test  facilities. 


4.0  SYSTEM  DESCRIPTION 


4.1  System  A 

4.1.1  General 


System  A  comprises  eight  UV  dual  detector  heads  53522-011,  a 
computer  control  unit  (CCU)  53813-203  and  a  crew  warning  unit 
(CWU)  53813-202.  Physical  characteristics  are  shown  in  Figures 
4-1,  4-2,  and  4-3,  respectively. 

Both  systems  were  designed  to  meet  the  requirements  of  the 
procurement  specification,  established  under  Phase  I  , 
and  described  herein. 

The  system  has  been  designed  to  respond  to  a  5  inch  diameter 
gasoline  pan  fire  at  a  distance  of  4  feet  with  a  response  time 
of  one  second.  However  once  the  fire  has  been  detected,  the 
warning  must  be  retained  with  only  half  of  the  pan  fire  obscured 
at  the  same  distance.  Thus  a  hysterisis  has  been  designed  into 
the  system  to  accommodate  this  part  of  the  specification. 

Figure  4-4  shows  the  complete  schematic  for  System  A  installation. 
Up  to  8  detector  heads  may  be  incorporated  in  a  system,  giving 
ample  coverage  of  hazard  conditions  in  most  engine  installations. 

In  the  event  of  a  fire,  the  sensors  in  the  UV  detectors  respond 
and  feed  signals  to  the  Computer  Control  Unit  (CCU)  ,  where  they 
are  processed  by  the  microprocessor  based  electronics.  The  CCU 
also  generates  the  power  for  the  detector  heads. 

The  system  is  designed  such  that  there  are  two  channels  ,  each  fed 
by  signals  from  half  of  the  UV  detector  heads.  It  is  then 
necessary  for  both  channels  to  identify  a  fire  warning  before  an 
indication  is  sent  to  the  CWU  for  display.  This  is  termed  'AND' 
logic. 

The  design  of  the  system  is  such  that  no  single  failure  of  any 
part  affects  the  fire  detection  capability  of  the  system,  and 
indeed  no  visual  indication  of  a  fault  is  indicated  even  though 
it  is  detected  internally.  In  addition,  the  design  allows 
considerably  more  system  degradation  without  either  losing 
detection  capability  or  signalling  a  fault  to  the  cockpit. 

Extensive  built  in  test  (BIT)  facilities  have  been  employed  to 
detect  internal  failures  and  switch  the  offending  channel  off. 
Under  single  failure  conditions  the  AND  logic  is  reconfigured  to 
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OR  logic  allowing  the  remaining  channel  to  generate  a  fire  warning. 
The  philosophy  here  is  that  while  the  system  is  still  capable  of 
detecting  a  fire  and  generating  a  fire  warning,  then  it  should 
remain  in  operation.  Component  failures  that  do  not  remove  fire 
detection  capability  are  not  signalled  to  the  cockpit  but  are 
logged  in  memory  for  subsequent  identification  during  -maintenance 
actions.  'OR'  logic  requires  that  only  one  channel  is  needed 
to  generate  a  fire  warning  signal. 

When  a  fault  is  detected  in  the  system  such  chat  a  fire  cannot  be 
detected  or  indicated,  then  a  fault  output  is  generated  on  the 
CWU,  which  is  mounted  in  the  cockpit. 

Verification  of  the  correct  function  of  BIT  is  provided  by  manual 
command  tests  at  the  CWU.  Two  test  buttons  are  employed  on  the 
CWU  which  artificially  Inject  fires  and  faults  into  the  system, 
which  are  processed  by  the  CCU  and  finally  energize  the  Fire 
and  Fault  lights. 

Provision  for  Ground  Support  Equipment  (GSE)  has  also  been  made 
and  this  is  discussed  later  in  Section  4  and  VOLUME  III. 

The  following  is  a  general  description  of  the  system.  A  more 
detailed  description  of  each  individual  item  is  given  in  Section 

5. 

A. 1,2  Detector  Head 

The  detector  head  has  been  designed  for  use  either  mounted  directly 
on  an  aircraft  engine  or  in  the  engine  bay  area,  where  ambient 
temperatures  can  reach  250°C. 

Each  detector  consists  of  a  plug  for  easy  removal  and  change,  2 
UV  sensors  and  2  UV  emitters;  the  construction  is  discussed  in 
Section  5.  Physical  characteristics  are  shown  in  Figure  4-1  and 
drawing  53522-011,  Reference  4-1. 

The  CCU  supplies  and  controls  the  320V  D.C.  necessary  for  operation 
of  the  sensors  and  emitters. 

Up  to  eight  detector  heads  can  be  driven  from  one  CCU,  which  would 
provide  adequate  coverage  of  hazard  areas  in  most  engine  instal¬ 
lations. 
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In  certain  parts  of  the  installation  two  or  more  detector  heads 
mav  view  the  same  area.  This  is  termed  adjacency  and  the  CCU 
checks  that  all  sensors  covering  a  particular  area,  give  a  similar 
output  under  fire  conditions. 

It  is  possible  that  under  very  fierce  fire  conditions,  a  detector 
head  may  be  destroyed  after  it  has  indicated  a  fire.  If  a  detector 
head  is  mounted  in  such  a  hazardous  position,  then  another  detector 
head  is  mounted  such  that  it  also  covers  the  hazardous  area.  Many 
combinations  of  adjacency  and  redundancy  are  allowable  within  the 
system  design  and  this  is  discussed  in  more  detail  in  Volume  II  of 
this  report. 

Each  detector  head  has  its  sensors  suonly  voltage  alternately  switched 
on  and  off,  such  that  one  sensor  views  while  the  other  sensor  is  off 
and  vice  versa.  This  reversal  occurs  every  167  mS. 

The  sensors  in  the  detector  operate  in  isolation  from  each  other, 
feeding  counts  directs  to  the  CCU. 

The  CCU  supplies  a  test  signal  to  each  emitter  on  the  detector  head, 
every  15  seconds .  Each  emitter  when  operated  emits  only  enough  UV 
to  test  its  own  sensor.  Hence  every  15  seconds,  the  CCU  can  deter¬ 
mine  how  many  sensors  are  functioning  and  reconfigure  itself  accord¬ 
ingly. 

As  an  example  of  this,  assume  an  adjacent  pair  of  detector  heads 
covering  one  hazard  area.  In  order  to  generate  a  fire  warning,  at 
least  one  sensor  from  each  half  of  the  detector  heads  must  detect 
(i.e.)  say  detection  head  1  has  sensors  Al  and  B1  and  the  adjacent 
detector  head  has  sensors  A2  and  B2.  A  fire  warning  is  generated 
only  from  any  one  of  the  following  sensor  outputs,  Al.Bl;  A1.B2; 

A2.B1:  A2.B2. 

If  the  BIT  detects  a  fault  with  a  sensor  say  Al  then  the  system 
reconfigures  to  A2.B1;  A2.B2  for  fire  generation.  If  now  Bl  becomes 
faulty  then  the  system  reconfigures  to  A2.B2  only. 

Finally,  if  B2  becomes  faulty,  then  the  system  will  reconfigure  so 
that  the  output  from  sensor  A2  only  would  generate  a  fire  warning. 

No  matter  how  many  detector  heads  are  adjacent,  the  system  will 
always  reconfigure  down  to  the  last  sensor. 

In  the  event  of  the  last  sensor  failing,  the  system  will  indicate 
a  fault  on  the  CWU. 


4.1.3  Computer  Control  Unit  (CCU) 

The  CCU  is  designed  to  be  installed  in  the  avionics  bay  of  the 
aircraft  and  is  the  interface  control  between  the  UV  detector 
heads  and  the  visual  Indication  on  the  CWU. 

It  consists  of  a  box  with  front  mounted  plugs  and  a  motherboard/ 
plug  in  a  card  assembly.  Physical  characteristics  are  shown  in 
Figure  4-2.  Further  details  are  described  in  Section  5  and  drawings 
for  the  CCU  are  53813-203-GA,  53813-203-ID  and  53813-203-CD.  The 
drawings  show  the  size  and  weight  of  the  unit  as  well  as  its  instal¬ 
lation  and  circuit  diagram.  (References  4-2,  4-3,  4-4,  respectively.) 

The  CCU  is  powered  from  two  115V  400  Hz  aircraft  supplies  and  one 
28V  D.C.  supply. 

The  CCU  contains  two  CMOS  RCA  1802  microprocessor  systems  each  with 
their  own  power  supplies  and  controlling  one  sensor  in  each  dual 
detector.  Thus  the  two  channels  of  fire  detection  are  isolated  except 
at  the  fire  warning  lamp,  where  they  become  common. 

Each  microprocessor  passes  information  to  the  other  so  that  AND 
logic  can  be  achieved  reliably. 

The  CCU,  every  15  seconds  completes  a  series  of  tests  to  ensure 
the  system  is  capable  of  detecting  and  indicating  a  fire. 

The  main  test  routines  for  each  microprocessor,  test  the  detector 
heads  by  energizing  their  emitters;  test  the  output  signal  paths; 
test  the  internal  microprocessor  program  and  also  tests  the 
opposite  microprocessors  signalling  and  processing  ability. 

Using  these  routines  it  is  possible  to  ensure  that  a  fire  will 
always  be  detected  unless  a  fault  signal  is  present  on  the  CWU. 

Circuit  description  and  operation  is  discussed  in  section  5. 
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4.1.4  Crew  Warning  Unit  (CWU) 


The  Crew  Warning  Unit  is  designed  for  use  with  two  engines  and  can 
be  used  with  both  System  A  and  System  B.  It  is  mounted  in  the 
cockpit  where  it  gives  visual  separate  indication  of  Fire  and 
Fault  conditions  for  both  engines  individually  by  means  of  lamps. 

One  test  button  is  used  to  check  both  engine  fire  systems  together. 
A  separate  test  button  checks  the  fault  signalling  capability  for 
both  engines. 

The  CWU  is  powered  from  the  28V  D.C.  power  supply  and  28V  signals 
are  derived  from  the  CCU  to  energise  the  warning  lamps. 

The  construction  and  operation  is  discussed  further  in  Section  5. 
Details  are  shown  on  53813-202  (Reference  4-5).  Figure  4-3  shows 
the  weight  and  size  of  the  unit. 

4.2  System  B 

System  B  comprises  eight  single  sensor  UV  detector  heads  53521-012, 
a  computer  control  unit  (CCU)  53813-204  and  utilizes  the  crew 
warning  unit  (CWU)  53813-202.  Physical  characteristics  are  shown 
on  Figures  4-5,  4-2,  and  4-3,  respectively. 

Figure  4-6  shows  the  installation  schematic  for  the  system  B  and 
comparing  with  system  A,  the  differences  are  as  follows. 

Eight  detector  heads  can  be  driven  from  one  CCU  but  the  detector 
heads  in  system  B  have  only  a  single  sensor  and  test  emitter. 

Thus  the  designed  redundancy  of  system  A  does  not  exist  and  this 
is  reflected  through  the  CCU  where  only  one  microprocessor  is 
used  for  the  control. 

System  B  also  has  adjacency  built  in  as  described  in  section 

4.1.2  but  obviously  is  confined  to  single  sensor  techniques. 

As  long  as  one  sensor  of  an  adjacent  set  is  operative  the  system 
will  respond. 

It  should  be  noted  that  a  single  detector  head  failure  will  only 
produce  a  fault  indication  in  the  event  that  it  does  not  belong 
to  an  adjacency  configuration. 
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The  function  of  system  B  approximates  to  half  of  system  A 
throughout  and  can  be  considered  as  similar  to  a  system  A  that 
has  already  reconfigured  to  an  OR  logic  mode,  as  described  in  4.1.1 

Physical  dimensions  of  system  B  detector  head  are  shown  on 
drawings  53521-012  and  system  B  CCU  on  drawings  53813-_204-GA 
(References  4-6  and  4-7).  The  installation  and  circuit  diagram 
drawings  for  the  CCU  are  53813-204-10  and  53813-204-CD  (References 
4-8  and  4-9). 


4.3  Ground  Support  Equipment  (GSE) 

The  GSE  is  basically  a  fault  diagnostic  maintenance  tool  and  is 
covered  in  Volume  III . 

The  GSE  identifies  only  faulty  LRU's  in  the  aircraft  system,  even 
if  these  have  not  been  signalled  to  the  CWU.  Additional  quantitive 
measurements  are  also  performed  by  the  GSE  which  permits  identifi¬ 
cation  of  any  trend  towards  unserviceability. 

A  further  use  of  the  GSE  is  to  extract  data  from  the  CCU  memory 
banks  on  in  flight  performance  of  the  system.  This  has  been 
particularly  useful  during  flight  testing  and  has  given  confidence 
in  the  behavior  of  the  system  in  the  absence  of  cockpit  indications 
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5.0  COMPONENT  DESIGN 


5.1  Detectors 

The  main  design  constraints  of  the  sensor  heads  arose  from  the 
requirement  to  use  the  proven  Graviner  D6100  UV  cell  with  its 
associated  UV  test  emitter,  to  withstand  the  environmental 
conditions  of  a  military  aircraft  engine  installation  -and  to  be 
as  small  and  lightweight  as  possible.  Physical  characteristics 
are  shown  on  Figures  4-1  and  4-5. 

Within  these  design  constraints  the  configurations  developed  and 
shown  on  drawings  53522-011  and  53521-012  are  probably  close  to 
and  optimum.  (References  4-1  and  4-6.) 

The  designs  are  based  on  the  assumption  of  production  quantities 
that  would  justify  expenditure  on  tooling  for  pressed  steel  case¬ 
work  but  the  sensor  assemblies  used  during  this  program  were 
fabricated  without  tooling  to  simulate  the  proposed  production 
design. 

The  photocell  and  protective  quartz  dome  are  mounted  on  a  thin 
steel  retainer  with  a  fillet  of  silicone  potting  compound.  This 
assembly  is  then  spot  welded  to  the  case.  In  early  development 
samples,  some  difficulties  were  experienced  with  emitter  glass 
envelopes  cracking  during  low  temperature  tests  but  this  was 
later  overcome  by  incorporating  a  resilient  rubber  compound 
coating  prior  to  emitter  assembly. 

The  simple  mounting  base  is  intended  for  use  with  a  variety  of 
aircraft  brackets  which  might  be  necessary  to  provide  appropriate 
viewing  directions  in  an  engine  installation. 

The  assembly  meets  the  required  life  of  10,000  hours  at  250°C  with 
the  exception  of  the  electrical  connector,  which  has  a  life  limited 
by  the  manufacture  to  1000  hours  at  250°C. 
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System  A  and  System  B  electronic  circuitry  is  contained  in 
mechanically  identical  racking.  General  Assembly  drawings 
53813-203  and  53813-204  show  pictorially  the  systems*  -con- 
truction.  (References  4-2  and  4-7.)  Physical  characteristics 
are  shown  on  Figure  4-2. 


The  essential  features  of  both  systems  are  as  follows: 


a)  It  is  a  box  construction  consisting  of  formed  top, 
bottom  and  side  panels,  with  two  similar  cast  end  plates. 
The  rear  panel  has  on  its  external  face  indented  locating 
slots  to  ensure  correct  positioning  of  the  units  in  the 
aircraft  racking  and  on  its  internal  face  it  contains 
guides  to  ensure  location  and  adequate  fixing  for  the 
printed  circuit  boards. 


The  front  panel  has  mounted  through  it,  two  captive  knurl 
headed  screws  to  provide  fixing  to  the  aircraft  racking. 

Two  circular  electrical  multipin  connectors  are  mounted 
through  the  front  panel.  One,  termed  on  the  front  panel 
label  the  'aircraft  plug* ,  routes  to  the  electronics  power 
and  signals  from  detectors  and  also  carries  the  signals 
to  the  crew  warning  unit  (CWU)  .  The  ae<  md  cor.«ect--.r . 
termed  the  GSE  plug,  is  utilized  when  the  system  is  i.;  »  - 
rogated  by  ground  support  equipment  and  is  not  normally 
used  when  the  aircraft  is  operational. 

Internally,  the  box  contains  a  cross  member  which  act®  to 
make  the  construction  more  rigid.  To  this  are  attached  the 
printed  circuit  board  guides. 

b)  Within  the  box  a  mother  board  printed  circuit  card  acts 
to  connect  the  various  parts  of  the  control  unit  electronics 
together.  On  the  mother  board  are  mounted  connectors  which 
mate  with  the  cable  harness  connected  to  the  two  circular 
connectors,  and  to  the  daughter  board  connectors.  The  mother 
board  also  houses  the  transformer  for  the  systems’  power  supply 
requirements. 
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c)  A  filter  board  is  mounted  on  the  front  panel,  close 
to  the  aircraft  plug  such  that  incoming  power  can  be 
filtered. 

d)  The  printed  circuit  cards  contained  within  the  units  are 
interconnected  via  the  mother  board,  and  consist  of,  in  the 
case  of  System  A,  a  common  logic  card,  two  microprocessor 
cards,  two  head  drive  cards,  a  master  logic  card  and  a  slave 
logic  card.  In  the  case  of  System  B,  the  unit  contains  a 
common  logic  card,  a  microprocessor  card,  a  head  drive  card, 
a  master  logic  card  and  a  battery  card  which  is  braced  such 
that  the  mass  of  batteries  does  not  cause  vibration  problems, 
Each  card  edge  connector  is  polarized  such  that  boards  cannot 
be  incorrectly  located  within  the  boxes. 

5 • 3  Circuit  Description 

A  block  diagram  of  the  CCU  is  shown  in  Figure  5-1.  This  is  shown 
to  give  a  general  appreciation  of  the  way  the  CCU  printed  boards 
interface  with  each  other.  Circuit  description  is  essentially  on 
a  board  by  board  basis.  Reference  is  made  to  the  CCU  circuit  dia¬ 
gram  53813-203CD  (System  A)  or  53813-204CD  (System  B) ,  for  a  clearer 
understanding  of  the  way  card9  are  interconnected.  (References  4-4 
and  4-9.)  Detail  description  of  the  circuit  design  can  be  found  in 
Volume  II. 


MAJNTAINENCE  UNIT 
INPUTS /OUTPUTS 


FIGURE  5-1  COMPUTER  CONTROL  UNIT  BLOCK  DIAGW 


6.0  SOFTWARE  DESIGN 


6 . 1  Overview  of  Software 

The  system  software  resident  in  3K  bytes  of  ROM  memory  serves  to 
control  timing  functions  of  the  system,  to  process  and  act  on  fire 
data  and  to  effect  many  system  tests  designed  to  prove  the  integritv 
of  the  system. 

The  assembled  program  listings  are  contained  in  Volume  II,  all  soft¬ 
ware  description  refers  to  the  relevant  program  and  should  be  read 
in  conjunction  with  the  system  flow  diagram  53813-203  and  204  FD. 
(Reference  6-1.) 

Program  structure  is  such  that  the  majority  of  functions  occur  under 
interrupt  control  due  to  the  time  dependent  nature  of  the  system 
requirements . 

6.1.1  Software  Component  Programs 

A  cyclic  operation  occurs  after  the  INITIALIZATION  program  has  been 
completed,  in  which  the  two  sides  of  the  system  (if  System  A)  are 
synchronized  and  all  required  registers  and  memory  locations  are 
set  to  initial  values. 

After  initialization  the  BACKGROUND  program  is  entered,  the  primary 
function  of  which  is  to  carry  out  tests  to  provide  that  ROM  memory 
is  not  corrupt.  This  program  is  interrupted  at  intervals  of  832  us 
to  carry  out  the  INTERRUPT  program. 

The  interrupt  program  has  two  phases,  GATHER  and  PROCESS,  both  are 
responsible  for  system  timing.  During  the  gather  phase  the  sides 
time  share  is  high  and  at  each  interrupt  event  the  main  function 
is  to  obtain  head  data.  This  phase  lasts  for  167ms. 

On  completion  of  the  gather  phase  the  time  share  changes  to  a  low 
level  and  the  PROCESS  phase  commences,  this  also  lasts  for  167ms. 

At  each  interrupt  event  during  the  process  phase,  system  timing 
and  system  interrupts  are  monitored. 

The  FIRE  program  is  responsible  for  processing  the  head  data  and 
computing  if  a  fire  or  fault  condition  is  to  be  set  or  reset.  The 
fire  program  is  executed  after  the  gather  phase  of  the  interrupt 
program  and  is  entered  from  the  background  program.  Consequently 
the  fire  program  is  interrupted  every  832  us  meanwhile  background 
operation  is  suspended.  Upon  fire  program  completion  background 
operation  resumes. 
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The  final  major  element  of  the  software  is  the  GSE  program  which 
is  executed  upon  command  of  the  remote  test  equipment. 

6.1.2  Program  Development 

All  programs  were  edited  and  assembled  using  an  RCA  develooment 
system  apart  from  the  fire  program  and  parts  of  the  GSE  program 
which  were  compiled  using  a  tie  to  a  main  frame  computer. 

Main  frame  written  program  was  debugged  in  the  same  medium  and 
then  combined  with  the  remaining  program  which  was  then  debugged 
using  the  RCA  development  system  and  associated  emulator.  A  more 
detailed  discussion  of  the  software  segments  can  be  found  in 
Volume  II. 
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7.0  FLICHT  TEST 


Flight  tests  were  conducted  on  a  General  Dynamics  FB-111A.  The  air¬ 
craft  was  made  available  at  McClellan  AFB,  Sacramento,  California 
where  installation  and  flight  testing  of  the  fire  detection  system 
took  place. 

Representatives  of  General  Dynamics  and  Graviner  supported  instal¬ 
lation  and  initial  flight  trials. 

7.1  Flight  Test  Plan 

The  requirements,  aims  and  methods  of  flight  tests  are  contained 
in  Appendix  A-l . 

7 . 2  Installation 

7.2.1  Commissioning  Prior  to  Engine  Installation 

System  installation  was  carried  out  in  accordance  with  installation 
drawing  Z22004  (Reference  7-1)  .  All  wiring  and  mounting  hardware 
was  installed  by  technical  personnel  of  McClellan  AFB. 

The  aircraft  wiring  was  checked  against  the  installation  drawing 
ensuring  that  all  screening  of  cables  was  correctly  carried  out. 

A  deviation  noted  was  that  the  method  used  to  pass  cables  through 
the  engine  fire  wall  caused  all  head  screens  to  be  jointed  together. 

On  the  non  engine  side  of  the  fire  wall  the  screened  cable  was  again 
commoned  together  at  the  fire  wall  connector  and,  as  per  installation 
drawings,  at  the  CCU.  This  configuration  formed  a  potential  earth 
loop  path,  however  due  to  the  shortage  of  pins  in  the  fire  wall 
connector  no  alternative  was  available. 

Prior  to  installation  in  the  empty  engine  nacelles  the  heads  were 
checked  oi*t  in  conjunction  with  ground  support  equipment. 

The  CCU  a  A  and  B  and  CWU  were  then  installed  in  the  aircraft 
^attrumentation  bay  and  cockpit  respectively,  Siting  of  the 
units  is  depicted  in  Figures  3  and  4  of  Appendix  A-l. 

With  ground  power  applied  to  the  aircraft  t,;:sr.em  was  switched 
on  by  closing  the  four  system  circuit  breake-s  located  in  the 
instrumentation  bay. 

Initial  system  checks  were  carried  out  by  observing  that  all  emitters 
struck  at  regular  15  second  periods.  The  FIRE  DETECT  TEST  button  of 
the  CWU  wag  depressed  and  fire  indication  of  the  LEFT  ENG  FIRE  and 
RIGHT  ENG  FIRE  was  observed.  In  this  mode  all  heads  were  viewed  to 
ensure  that  all  emitters  flashing  in  sympathy  with  the  time  share  period 

The  FAULT  INDICATION  TEST  button  of  the  CWU  was  depressed  and  fault 
indication  of  the  left  and  right  FIRE  DETECT  FAIL  indicators  was  noted. 
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Fire  conditions  were  simulated  with  a  UV  light  source  termed  a 
’wand' .  The  system  proved  to  respond  correctly  to  the  UV  light 
source. 

Further  confirmation  of  correct  operation  was  then  carried  out 
using  the  ground  support  equipment. 

Initial  attempts  to  connect  the  GSE  according  to  the  method  laid 
down  proved  unsuccessful. 


Connection  method  was  to  mate  cable  1  of  the  GSE  to  the  GSE  connector 
on  the  CCU  to  be  tested  prior  to  disconnection  of  the  aircraft  hames 
from  the  CCU.  The  aircraft  harness  was  then  to  be  mated  to  cable  2 
of  the  GSE  and  the  CCU  aircraft  plug  to  cable  3.  The  whole  operation 
was  carried  out  without  removing  power  from  the  system  by  breaking 
the  contactors. 

It  was  found  that  this  technique  caused  random  corruption  of  RAM 
memory  locations,  a  phenomenon  not  observed  when  system  tests  were 
conducted  at  place  of  manufacture. 

Due  to  the  specialized  nature  of  test  equipment  required  to  investi¬ 
gate  the  fault,  the  cause  was  not  discovered.  However  the  solution 
was  to  modify  the  method  of  connection. 

By  initially  removing  power  by  pulling  first  28V  and  then  115V 
circuit  breakers  before  performing  the  connection  procedure  nc 
loss  of  memory  occurred. 

Tests  were  then  performed  to  prove  that  the  GSE  would  analyze  head 
data  correctly.  Each  head  was  separately  stimulated  with  a  fire 
condition  from  the  UV  wand,  at  the  same  time  all  other  heads  were 
screened  from  viewing  the  fire  source,  For  each  head,  correct 
identification  (by  fire  area)  was  observed  at  the  GSE.  Data  and 
time  of  event  was  issued  correctly. 

The  system  was  then  caused  to  fail  by  removing  heads,  one  adjacency 
set  at  a  time.  The  system  was  observed  to  fail  correctly  by  indi¬ 
cation  on  the  relevant  CWU  fault  lamp.  Ground  support  equipment 
was  then  used  to  prove  correct  identification  of  the  area  of  failed 
fire  cover. 

7.2.2  Commis atoning  With  Engine  Installed 


The  first  attempt  to  install  engines  showed  that  it  was  necessary  to 
relocate  heads  at  the  770  frame  to  ensure  that  fouling  of  heads  by 
the  engine  did  not  occur. 


It  was  noted  at  this  time  that  the  orientation  of  the  detectors 
at  the  rear  of  the  engine  nacelle  was  not  ideal.  Position  of 
heads  4  and  5  were  observed  to  be  such  that  the  most  sensitive 
viewing  segment  of  the  detector  electrodes  was  in  line  with  the 
after  burner  plume. 

With  the  engines  installed  the  systems  correct  operation  was  con¬ 
firmed  with  GSR  and  by  performing  tests  with  the  UV  wand. 

Representatives  of  General  Dynamics  then  carried  out  EMC  tests  in 
accordance  with  the  requirements  of  the  Flight  Test  Plan  of 
Appendix  A-l. 

7.2.3  Commissioning  With  Engine  Running 

Initial  engine  runs  with  reheat  showed  that  the  heads  were  responding 
to  the  UV  content  of  the  afterburner  plume. 

Data  obtained  from  connection  of  the  GSE  showed  that  Area  3  (the  area 
rear  of  the  770  frame)  was  responsible  for  the  fire  indication. 

Appendix  A- 2  contains  data  readouts  obtained  during  the  flight  trials 
period . 

Figure  1  of  Appendix  A-2  shows  the  readout  from  System  B  immediately 
after  the  engine  run.  Data  analysis  showing  that  a  single  fire  event 
in  area  3  was  logged.  System  A  however  did  not  issue  a  fire  condition 
although  data  readout  did  show  that  area  3  heads  responded  to  the 
afterburner. 

To  overcome  this  it  was  necessary  to  shield  the  heads,  i.e.  to  restrict 
their  field  of  view.  It  was  difficult  to  gain  access  to  effect  shield¬ 
ing  of  the  responsible  heads  with  the  engine  in  place.  General . Dynamics 
personnel  made  the  decision  to  disconnect  the  left  and  right  inboard 
area  3  head  because  acct-ns  to  it  was  impossible.  Head  5  disconnection 
v - 3  performed  by  removing  appropriate  cables  at  the  aircraft  plugs. 

Head  4  shielding  was  accomplished  by  painting  the  glass  domes  of  the 
sensors  with  black  paint  so  that  the  electrodes  were  only  viewing  the 
fire  area.  A  check  was  then  carried  out  with  the  UV  wand  to  prove 
that  the  afterburner  plume  was  not  visible  to  the  detectors  but  that 
the  fire  area  was. 

Figure  2  of  Appendix  A-2  shows  data  analysis  of  system  B  subsequent 
to  the  third  engine  run  which  proved  that  no  response  to  the  after¬ 
burner  occurred.  During  this  run  the  stabilizers  were  rotated  to 
check  that  reflections  of  the  plume  were  not  incident  on  the  detector. 
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7 . 3  Failure  of  Heads 


Immediately  after  engine  tests  it  was  observed  that  there  was  a 
tendancy  for  heads  to  fail  on  the  periodic  self  test  sequence. 

This  was  shown  by  GSE  readouts,  a  typical  example  is  shown  in 
Appendix  A-2.  Figure  3.  The  data  circled  shows  a  failure  of 
head  2.  It  was  observed  that  the  tendancy  for  failure  occurred 
when  the  aircraft  was  first  powered-up  each  day.  After  resetting 
the  fault  with  ground  support  equipment  no  further  re-occurrence 
of  head  failure  was  noted  until  after  the  system  had  remained  off 
for  a  few  hours . 

Because  the  fault  was  resettable,  flight  trials  were  carried  out 
by  resetting  the  system  with  GSE  immediately  before  a  flight.  An 
investigation  into  the  cause  of  failure  is  discussed  in  Section  7.5. 

7. A  Dedicated  Flight  Trials 

7.A.1  Flight  1 

The  first  flight  was  carried  out  on  9  September,  1980  during  which 
the  aircraft  attained  an  altitude  of  46000  feet  and  an  air  speed  of 
MACH  2.05.  Appendix  A-2.  Figure  4  shows  data  read  out  of  Systems  A 
and  B  after  the  flight.  A  GSE  readout  was  not  available  at  this  time 
as  the  failures  of  7.3  were  thought  to  be  associated  with  attaching 
the  readout  equipment. 

Analysis  of  the  data  shows  that  all  heads  remained  functional  through¬ 
out  the  flight,  no  fire  conditions  were  logged  and  no  head  strikes 
were  recorded.  Total  duration  of  system  operation  was  approximately 
three  and  a  half  hours. 

Aircrew  reported  correct  response  to  CWU  tests  and  no  indication  of 
fire  or  fault  conditions  throughout  the  flight.  It  was  noted  that 
this  flight  was  more  severe  than  the  requirement  of  the  first  flight 
laid  down  in  Appendix  A-i. 

7.4.2  Flights  2  and  3 

Flights  2  and  3  of  Appendix  A-l.  were  combined  into  one  sortie. 

Data  from  the  flight  carried  out  on  11  September  1980,  is  shown  in 
Figure  5  of  Appendix  A-2. 

Note:  That  both  A  and  B  systems  correctly  declare  the  disconnected 
head  number  5  as  faulty. 

The  flight  data  shows  that  no  fire  or  fault  conditions  were  logged 
during  flight  and  that  no  heads  failed. 
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System  B  was  noted  to  have  had  one  gate  time  filled  as  defined  by 
a  count  of  1  at  level  1  in  the  Flight  Data  section. 

Aircrew  reported  correct  response  to  CWU  tests  and  no  indication  of 
fire  or  fault  conditions  throughout  the  flight. 

7.4.3  Flight  4 

The  fourth  flight  of  Appendix  A-l.  attained  a  height  of  40,500  feet 
and  a  maximum  airspeed  of  MACK  2.15. 

Figure  6  of  Appendix  A- 2.  is  data  obtained  from  the  flight. 

Data  readout  and  aircrew  response  proved  that  the  system  performed 
correctly. 

It  is  noted  that  System  B  recorded  5  gates  filled  during  the  flight, 
while  side  2  of  System  A  recorded  1  gate  filled. 

7.4.4  Nacelle  Temperature  Data 

For  flight  trials,  McClellan  AFB  technicians  installed  a  temperature 
monitoring  system  such  that  a  temperature /time  plot  of  ambient  tempera¬ 
ture  at  each  head  could  be  recorded  and  subsequently  analyzed.  Appendix 
A-3.  contains  the  temperature  data  obtained  from  flight  3. 

From  the  data  it  was  observed  that  the  highest  temperature  occurred 
at  head  3  of  System  B  recording  310°F.  This  temperature  was  attained 
while  the  aircraft  was  running  afterburner  at  MACH  2.15  for  an 
extended  period  of  time. 

7.4.5  Non  Dedicated  Flights 

Flights  made  subsequent  to  the  dedicated  flights  of  Section  7.4  were 
not  attended  by  Graviner  personnel. 

The  following  is  a  summary  of  all  flights  carried  out  during  the  period 
September  1980  to  April  1981. 


FLIGHT  TEST  TIME  ON  FB-lllA  NOl  (67-159) 


FIRST  FLIGHT  9th  SEPTEMBER,  1980 

DEDICATED  FLIGHTS  COMPLETED  12th  SEPTEMBER,  1980 


1980 

SEPT. 

3  SORTIES 

5.4  HOURS 

1  FLT.M2  at  46K  FT. 

1  FLT.M2  at  40k. FT. 

1  PLT.  SUBSONIC 

OCT.- 

DEC. 

10  SORTIES 

13.9  HOURS 

SUBSONIC 

1981 

JAN.- 

FEB. 

3  SORTIES 

8.7  ''OURS 

SUBSONIC 

LAST  PLIGHT  IN 

FEBRUARY  WAS  IN  A/B 

FOR  45  MIN.  at  MACH. 94 

MARCH 

2  SORTIES 

4.0  HOURS 

SUBSONIC 

APRIL 

2  SORTIES 

1.6  HOURS 

SUBSONIC 

20  SORTIES 

33.6  HOURS 

NOTE: 

(1) 

A/B  USED  ON  ALL 

FLIGHT  TAXE  OFFS. 

(2) 

UV  FIRE  DETECTION  SYSTEM  IS  OPERATIONAL  EVERY  TIME 
AIRCRAFT  GROUND  POWER  IS  TURNED  ON.  IT  IS  ESTIMATED 
THAT  THE  UV  PIRE  DETECTION  SYSTEM  HAS  IN  EXCESS  OP  350 
HOURS  OF  OPERATION  FROM  SEPTEMBER,  1980  THROUGH  APRIL, 
1981 

7.4.6  Problems  Encountered  During  Flight  Test  1 

The  following  is  a  summary  of  problens  encountered  during  the  flight  I 

test  period  September,  1980  to  April, 1981.  1 


PROBLEM 


CAUSE  AND  RESOLUTION 


On  initial  system 
installation  fire  warning 
light  on  during  ground 
A/B  operation. 


o  UV  radiation  from  A/B  plume 
triggered  warning  light  on. 

o  Mask  field  of  view  of  detector 

tube  from  UV  radiation  reflections. 


Fire  warning  light  on 

o  (1) 

approximately  5  seconds 

during  flight  16  when 

coming  out  of  A/B. 

o  (2) 

Found  paint  peeled  off  mounting 
hole  cover  leaving  shiny  surface. 

Paint  flaked  off  in  mask  area 
of  tube.  Believe  UV  radiation 
reflections  cause  of  fire 
warning  light. 


o  Painted  cover  and  retouched  mask 
area. 


o  Normal  operation  on  last  4  flights. 


Random  fail  light 
during  aircraft  ground 
power-up. 

No  occurrences  in  flight. 


o  Reluctance  of  the  automatic 
test  emitter  to  fire  after 
and  extended  off  period  (see 
Section  7.5). 

o  Added  reset  function  to  CWU 
test  button  in  Crew  Station 
(see  Section  7.6). 
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7 . 5  Fault  Investigation 


The  failure  of  some  heads  (randomly)  to  respond  to  emitters  was 
initially  investigated  remotely  by  requesting  AFB  technicians  to 
perform  tests  that  might  reveal  the  cause.  Simultaneously,  at 
Graviner,  tests  were  performed  on  an  equivalent  installation. 

However,  the  observed  fault  was  not  duplicated. 

Subsequently,  a  visit  by  Graviner  representatives  was  arranged  and 
Appendix  A-4.  contains  the  report  of  investigations  carried  out. 

7.6  Modification  Resulting  from  Flight  Trials 

Paragraph  3.3.  of  Appendix  A-4.  proposed  a  procedure  to  reset  the 
system  memory.  This  modification  is  discussed  in  Appendix  A-5. 

7.6.1  Description 

The  wiring  requirements  of  the  modification  and  the  relevant 
associated  circuits  is  shown  in  Figure  7.1. 

With  the  GSE  input  line  3  tied  to  zero,  the  program  code  at  the 
proce-  ~>r  (when  an  input  on  port  6  is  executed)  instructs  the  micro- 
proce  „*  to  carry  out  the  subroutine  RAM  RETENTION  (PART  A)  ,  see 
Volume  il.  This  will  only  occur  if  GSE  input  line  4  has  been  pulled 
low  (the  input  which  determines  whether  a  fire  program  of  GSE  program 
is  to  be  run) . 

If  during  flight  either  the  fire  test  or  the  fault  test  buttons  are 
separately  pressed,  no  effect  on  the  system  operation  occurs.  Press¬ 
ing  the  fire  test  button  connects  a  reverse  biased  diode  to  the  GSE 
3  and  4  input  lines  pull  up  resistors.  If  the  fault  test  button  is 
pressed  after  power  up,  the  program  has  passed  the  point  at  which  it 
looks  at  the  GSE  input  lines  to  determine  which  program  is  to  be  run. 

If  the  fire  button  is  depressed  and  held  followed  by  a  depression 
of  the  fault  button  a  zero  return  path  for  the  diode  D6  now  exists 
and  the  capacitors  Cl  are  discharged  resulting  in  the  logic  card 
CLR  (NOT)  line  being  set  to  reset  state. 

If  the  fire  button  is  released  and  the  fault  switch  still  held  the 
reset  condition  is  removed  and  system  program  operation  begins  at 
H'0000'.  This  causes  port  3  to  be  read  resulting  in  the  execution 
of  program  RAM  retention  part  A. 

With  the  fault  button  still  depressed  the  fire  button  is  again 
depressed  causing  a  second  reset. 
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Releasing  the  fault  button  and  subsequently  the  fire  button  starts 
execution  at  memory  location  H'0000'. 

This  time  the  system  will,  due  to  coding  on  input  port  3,  execute 
the  fire  detection  program.  When  interrogating  memory  locations 
0C01  and  0C03  the  identity  A5,A5,A5,  is  not  observed  because  the 
GSE  program  caused  it  to  be  set  to  01,02,03.  Therefore,  as 
described  in  Volume  II  a  memory  reset  occurs,  thus  removing  any 
faulty  head  identification  from  memory  location  OCC5. 

The  sequence  therefore  provided  a  simple  method  of  reset  from  the 
cockpit  station  to  enable  flight  testing  to  continue  gathering 
performance  information. 
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8.0  ITEMS  TO  BE  RESOLVED 


During  this  program  some  items  arose  which  are  either  not  fully 
resolved  or  at  least  merit  further  consideration  in  relation  to 
any  future  installation.  These  are  identified  as  follows: 

8.1*  FAIL/FIRE  Precedence 

The  original  SOW  is  anomalous  in  that  a  oara.  1. 3.2.2.  it  is  stated 
that  a  FAIL  warning  shall  override  a  FIRE  warning  except  in  the  case 
where  a  FIRE  warning  is  given  first.  The  practical  significance  of 
this  in  the  program  relates  to  the  manner  in  which  the  test  emitter 
lines  are  driven.  In  order  to  meet  the  requirements  of  SOW  para. 

1.4. 1.3.  (Exposure  to  Flame),  it  is  necessary  to  ensure  that  ground¬ 
ing  of  an  emitter  drive  wire  in  the  sensor  immersed  in  flame  does 
not  inhibit  emitter  tests  on  other  sensor  heads,  otherwise  the  system 
will  properly  determine  a  FAULT  mode  and  override  the  FIRE  signal. 

It  is  relatively  easy  to  guard  against  this  by  either  driving  emitter 
lines  separately  or  through  resistors  to  ensure  that  single  emitter 
grounding  does  not  disable  other  emitter  drive  leads. 

In  the  flight  test  installation  on  FB-111A  this  degree  of  separation 
was  not  incorporated.  For  any  further  installation  it  is  suggested 
that  the  trade-off  of  system  wiring  weight,  desired  operational  mode 
and  EMC  testing  may  need  further  consideration. 

8 . 2  Emitter  Start  up 

In  the  flight  test  program  a  problem  was  experienced  of  emitters  being 
reluctant  to  strike  after  a  long  'off'  period.  In  subseouent  investi¬ 
gation  it  was  determined  that  almost  any  radiation  on  the  emitter, 
from  visible  indication  to  a  radioactive  source,  is  sufficient  to  pre¬ 
vent  the  phenomenon.  On  the  flight  test  system  the  problem  was  cir¬ 
cumvented  by  providing  a  simple  cockpit  reset  procedure  but  this  would 
not  be  acceptable  in  future  production  systems. 

The  preferred  solution  is  to  add  a  trace  of  radioactive  gas  to  the  low 
pressure  gas  fitting  of  the  test  emitters.  No  problems  are  seen  in 
implementing  this  modification  but  it  is  not  yet  tried. 

Alternative  less  prefared  solutions  are  on  initial  higher  electrode 
voltage  to  ensure  starting  in  the  absence  of  radiation  or  an  external 
radioactive  source. 
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9.0  DEVELOPMENTAL  POTENTIAL 


The  System  as  fitted  to  the  F-lll  has  proved  to  be  entirely  satis¬ 
factory  with  regard  to  the  key  parameters  set  out  in  the  original 
program  objectives  which  were  an  extremely  low  false  alarm  risk 
and  a  high  probability  of  sensing  a  fire. 

Both  these  parameters  have  been  demonstrated 

A)  By  the  actual  flight  test  program,  whereby  no  false  alarms 
have  been  detected. 

B)  By  recovering  information  on  the  Ground  Support  Equipment 
which  determines  that  there  is  adequate  margin  of  safety 
between  the  current  operating  conditions  and  the  fire 
detection  levels. 

C)  By  the  inadvertant  use  of  the  afterburner  system  in  an  area 
that  allowed  reflection  of  the  flame  image  to  be  seen  by 
some  of  the  tubes  which  promptly  gave  a  fire  warning,  thereby 
demonstrating  the  capability  of  responding  to  a  true  fire 

s ituation . 

D)  By  Design  calculations  based  on  the  measured  performance  of 
UV  sensors  to  fires  and  other  unwanted  signal  sources. 

Against  this  background  of  success  as  a  rapid  response  fire  detection 
system,  further  potential  for  the  development  of  the  equipment  is 
examined  under  the  following  main  headings: 

*  Cost  Reduction  of  UV  Fire  Detection  System. 

*  Combined  Fire  and  Overheat  Detection. 

*  Other  applications. 

9 . 1  Cos t  Reduction 

In  the  areas  of  cost  reduction,  three  factors  operate  in  favor  of 
further  development  of  this  system,  namely: 

Hardware  development . 

Volume  production. 

Removal  of  development  data  requirements. 

9.1.1  Hardware  Development 

The  cost  of  hardware  used  on  this  program  has  already  been  reduced 
dvrinp  the  two  year  span  since  original  hardware  was  specified. 


This  is  the  continuing  impact  of  the  development  of  the  Micro¬ 
processor  industry,  thus  any  production  system  specified  even  if 
the  requirements  were  identical,  would  be  reduced  in  cost. 

9.1.2  Production  Volume 

The  prototype  equipment  of  necessity  employed  discrete  components 
in  many  areas  where  if  a  reasonable  production  run  was  forecast, 
adequate  tooling  and  dedicated  circuit  design  would  allow  for 
reduction  of  component  count  with  some  substantial  side  benefits. 

For  example: 

*  The  reduction  in  the  number  of  circuit  boards  in  the  system. 

*  Reduction  in  the  overall  volume  of  the  system. 

*  Reduction  in  the  power  requirements  for  the  systei... 

It  is  estimated  that  a  series  production  CCU  can  be  reduced  to  one 
quarter  the  volume  and  less  than  one  half  the  weight  of  units  used 
in  this  program 

9.1.3  Removal  of  Development  Data  Requirements 

For  production  use,  much  of  the  data  collection  facilitiec  that  wer? 
made  available  both  in  the  Ground  Support  Equipment  and  on  the  flight 
hardware  would  not  be  needed.  This  would  impact  the  quantity  of 
hardware  to  be  carried  with  the  above  mentioned  side  benefits.  A 
minimum  display  can  be  envisaged  which  would  simply  identify  a  faulty 
LRU  for  maintenance  personnel. 

The  retention  of  flight  test  data  made  it  necessary  to  incorporate 
batteries  to  maintain  power  on  the  memory  during  the  time  the  air¬ 
craft  power  is  turned  off  and  the  data  is  extracted  from  the  memory. 

A  non  volitile  RAM,  being  developed  during  the  design  period  was 
not  available  and  consequently  the  battery  power  was  required.  For 
production  any  data  retention  could  be  accomplished  with  a  non  volitile 
RAM. 

9.1.4  Combined  Fire  and  Overheat  Detection 

A  significant,  advance  made  in  this  program  has  been  the  application 
of  a  microprocessor  based  control  unit  to  an  aircraft  fire  detection 
system.  The  capabilities  of  the  microprocessor  system  are  that  it 
can  handle  rs  '.dly  large  amounts  of  incut  data,  can  provide  logical 
interpretation  >f  that  data  and  can  provide  a  variety  of  outputs 
(Alarms,  Fault  indications,  Maintenance  data). 
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"'he  same  capabilities  that  have  been  applied  to  the  fire  hazard 
:  -.ply  equally  veil  to  the  hot  gas  leak  or  overheat  hazard.  The 
overheat  hazard  may  well  have  an  occurrence  rate  4  or  5  times 
greater  than  the  fire  occurrence  rate  on  military  aircraft  engines, 
but,  if  accurately  identified,  does  not  necessitate  the  same 
emergency  actions.  As  noted  above,  the  UVAFDS  provides  accurate 
identification  rf  the  fire  conditions.  The  microprocessor  control 
unit  is  well  ' e  to  handle  other  input  data  which  may  be  derived 
from  a  conti:  s  cable  type  sensing  system  and  the  unit  can  inter¬ 

pret  the  data  .0  provide  separate  fire  and  overheat  alarm  outputs. 

The  combined  system  is  therefore  considered  to  be  a  logical  next 
step  in  the  development  of  improved  hazard  protection  systems. 

9.1.5  Other  Applications 

Other  applications  of  this  system  which  might  be  considered  in 
further  studies  are  listed  as  follows: 

*  Analysis  of  in  flight  trends  -  Analog  data  logged  particularly 
from  cable  sensor  systems  can  provide  an  engine  condition 
monitor . 

*  Advanced  Maintenance  planning  -  The  re-configuration  decisions 
made  in  a  system  containing  such  a  large  degree  of  redundancy 
can  provide  advanced  planning  data  for  maintenance  actions. 

*  Battle  damage  management  -  Several  links  are  possible  between 
the  subject  system  and  aspects  of  the  battle  damage  situation. 
There  include  detection  of  attack  induced  fires,  deployment  of 
suppression  means  without  pilot  intervention,  addition  of  other 
emergency  equipment  to  the  microprocessor  test  routines  and 
links  with  fuel  management  systems. 


10.0  CONCLUSIONS 


The  objectives  o£  this  program  have  been  met.  A  UV  fire  detection 
system  has  been  developed,  fabricated  and  test  flown  on  a  high 
performance  aircraft.  The  system  has  a  fire  detection  reliability 
and  a  freedom  from  false  warnings  which  is  significantly  better 
than  any  existing  service  equipment.  A  high  degree  of  redundancy, 
self  checking  and  automatic  reconfiguration  is  built  into  the  system 
providing  both  a  reduction  in  pilot  work  load  and  reduction  in 
unscheduled  maintenance  actions.  The  system  is  considered  suitable 
for  near-term  service  applications. 

The  initial  cost  of  the  new  system  is  estimated  as  being  2.5  times 
present  systems  but  the  total  life  cycle  cost  as  0.4  or  less. 

A  logical  development  of  the  new  system  is  seen  to  be  in  the  incor¬ 
poration  of  overheat  signalling,  where  similar  reliability  improve¬ 
ments  can  be  made  at  low  technical  risk. 
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1.0 


1 


Test  Objectives 

The  test  objectives  for  the  Advanced  Aircraft  Fire  Detection 

System  that  utilizes  ultra  violet  radiation  principles  for  the  detection 

of  aircraft  fires  is  to  accomplish  the  following  during  flights  on  an 

F-lll  test  aircraft: 

a.  Demonstrate  that  no  false  warnings  occur  during  the  flight  test 
program. 

b.  Demonstrate  system  reliability  when  subjected  to  operational 
service  type  environment. 

c.  By  use  of  an  ultra  violet  radiation  generator  (Wand),  demonstrate 
that  the  system  has  the  capability  of  detecting  a  fire  as  it  is 
Installed  in  the  test  aircraft. 

d.  Measure  safety  margins  available  above  random  ultra  violet 
radiation  that  may  strike  the  UV  fire  detector  tubes. 

e.  Compare  the  simplified  System  "B"  performance  that  is  Installed  in 
one  engine  nacelle  with  the  performance  of  System  "A"  that  is  more 
complex  in  design  and  is  installed  in  the  other  engine  nacelle. 

f.  Demonstrate  that  the  detector  fire  detection  sensicivity  is  not 
reduced  due  to  contamination  collected  on  the  ultra  violet  (UV) 
fire  detector  tubes  during  aircraft  operation. 

g.  Demonstrate  the  reliability  of  the  system  in  a  maintenance 
environment  (Example,  engine  removal  and  installation). 


8  I 


A 


System  Description 


The  systems  to  be  flight  tested  utilize  ultra  violet  (UV)  radiation 
energy  present  in  hydrocarbon  fires  for  their  operation.  The  UV  fire 
detector  tube  is  made  of  a  borosllicate  glass  envelope  containing  metal 
electrodes  and  a  low  gas  filling.  The  UV  energy  from  a  fire  ionizes  the 
gas  and  causes  the  electrodes  to  conduct  and  allow  current  flow. 

Each  system  is  comprised  of  UV  fire  detector  units,  a  computer 
control  unit  (CCU) ,  and  a  crew  warning  unit  (CWU) . 

Two  systems  will  be  installed  on  an  FB-111A  test  aircraft.  System 
"A"  incorporates  dual  UV  fire  detector  heads,  automatic  self  testings 
redundant  components,  and  fire  detection  verification  using  the  dual 
detector  heads  and  software  programming.  These  design  features  result 
in  s  high  degree  of  reliability.  System  is  a  simplified  version  of 
System  "A".  System  "B"  will  use  one  UV  fire  detector  head  and  one  half 
of  the  components  in  the  CCU  of  System  "A".  These  two  systems  will  be 
completely  Independent  from  the  production  installed  fire  detection  system. 

System  "A"  will  be  installed  in  the  left  engine  nacelle  and  System  "B" 
will  be  installed  in  the  right  hand  engine  nacelle.  One  CCU  for  System  "A" 
and  one  CCU  for  System  "B"  will  be  Installed  in  the  electronics  bay.  A 
common  crew  warning  unit  (CWU)  panel  will  be  installed  in  the  crew  compart¬ 
ment.  This  panel  will  incorporate  a  fire  warning  light  and  a  fail  indication 
light  for  System  "A"  and  a  fire  warning  light  and  a  fall  indication  light 
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2.0 


continued : 


for  System  "B".  Two  teat  switches  will  be  used.  One  test  switch  will 
test  the  fire  warning  portion  of  the  systea  of  both  System  "A"  end 
System  "B"  simultaneously .  The  other  test  switch  will  be  to  test  the 
fell  Indication  portion  of  the  system  of  both  Systea  "A"  end  System  "B" 
simultaneously . 

3.0  Maintenance  Checkout  Unit  (CSE) 

The  CSE  is  utilized  for  two  Modes  of  operation.  The  Data  gathering 
mode  will  be  used  after  each  flight  to  Interrogate  the  CCU  memory  to 
measure  safety  margins  and  ocher  events  during  flight  that  are  useful 
for  evaluating  systea  operation.  The  Test  Mode  will  be  used  to  check 
system  operstlon.  Self  contained  battery  packs  In  the  System  "B"  CCU 
will  maintain  slsctricsl  power  on  both  systems  to  retain  flight  data  in 
the  memory  banks  after  engine  shut  down  In  order  for  the  CSE  to  obtain 
stored  flight  data. 

4.0  Installation  Description 

Installation  of  System  "A"  and  System  "B"  is  as  shown  on  Figure  142, 
The  installation  of  these  two  systems  will  require  the  removal  of  both 
engines.  Five  dual  UV  fire  detectors  are  Installed  In  the  left  hand 
engine  nacelle  for  Systea  "A"  and  five  single  UV  fire  detectors  are 
installed  In  the  right  hand  engine  nacelle  for  System  "B".  The  location 
of  the  detectors  are  as  follows: 


*1 
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4.0  continued: 


°  Lower  engine  fire  well,  Fuselage  Station  593. 

°  Outboard  engine  access  door  forward  of  Fuselage  Station  725  frame. 

°  Forward  surface  of  inboard  Fuselage  Station  770  frame. 

°  Upper  aft  inboard  aurfaca  of  Fuselage  Station  770  frame. 

°  Upper  aft  outboard  surface  of  Fuselage  Station  770  frame. 

A  CCU  for  System  "A"  and  a  CCU  for  System  "B"  is  installed  in  the 
electronic  equipment  bay  as  shown  on  Figure  3. 

A  Crew  Warning  Unit  (CUU)  is  installed  in  the  crew  compartment  as 
shown  on  Figu'-**  4.  High  temperature  shielded  and  unshielded  wire  will 
be  routed  from  the  UV  fire  detectors  of  each  system  through  electrical 
connectors  on  the  engine  fire  wall.  One  electrical  connector  will  be 
added  to  the  left  engine  fire  wall.  An  i^iat'ng  connector  on  the  righc 
hand  fire  wall  will  be  utilized  for  routing  of  System  "B"  elctrical  wire. 

115  Volt  400  hertz  power  will  be  requJ  t<a  for  the  operation  of  each 
system  along  with  28  Volt  DC  for  the  lights  and  awitches  on  the  CWU. 

5.0  Functional  Checks 

The  following  is  planned  for  the  functional  checks:  with  the 
engines  removed  and  prior  to  engine  installation,  apply  power  to  the 
aystems  and  check  systems  utilizing  the  CSE,  a  UV  wand  to  simulate  a 
fire,  and  the  CWU  teat  awitches  in  the  crew  station. 

After  engines  are  installed,  repeat  the  above  check  with  the  engine 
access  doors  open. 
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6. 0  Iniclal  Engine  Run  Checks 

a.  Prior  co  engine  start  up,  and  as  soon  as  power  Is  supplied,  check 

System  "A"  and  System  "B"  by  means  of  the  test  switches  on  the  CWU. 

Record  the  time  the  test  switches  are  pressed. 

NOTE:  Electronic  log  of  this  timing  is  also  carried 
in  the  CCU  for  readout  by  the  GSE. 

b.  When  checks  have  been  completed,  start  engines  and  ground  run 
for  15  minutes.  Afterburner  operation  must  be  included  with  a 
log  of  the  start  and  stop  times  of  afterburner  use. 

c.  Shut  engines  down  and  check  systems  using  the  GSE. 

d.  Restart  engines,  taxi  and  locate  aircraft  in  sunlight  on  parking 

apron.  Note  ambient  temperatures.  Run  engines  at  idle  for  a  period 

of  ten  minutes.  Rotate  aircraft  90°,  idle  again  for  ten  minutes, 
o 

Repeat  360  rotation  of  aircraft  has  been  completed.  Note  positions 
and  timing  in  log. 

e.  Shut  dovn  engines  and  check  systems  using  the  GSE. 

7.0  Initial  Plight  Test 

a.  Perform  crew  station  checks  and  note  time  of  test  switch  operation. 

b.  Fly  two  circuits  of  the  airfield  and  land. 

c.  Recheck  system  using  GSE. 

d.  Park  aircraft  in  hot  sun  for  five  hours,  nose  north,  with  ground 
power  on  and  system  energized. 

e.  Recheck  system  using  GSE. 


7.0  Flight  Test  Procedure 


System  flight  testing  shall  consist  of  two  parts  (1)  dedicated 
sorties  and  (2)  service  experience  concurrent  with  other  flight  terting. 

7.1  Dedicated  Sorties 

The  following  is  the  specific  flight  profiles  required  In  addition 
to  service  experience  from  other  flight  testing: 

7.1.1  Initial  Flight 

(a)  Perform  crey  station  checks  of  fire  warning  and  fail  caution 
light  and  note  time  of  test  switch  operation. 

(b)  Takeoff  and  fly  two  circuits  of  base  and  land. 

(c)  Connect  Ground  Service  Equipment  (GSE)  and  check  system  and 
obtain  data. 

(d)  Park  aircraft  in  hot  sun  for  five  hours,  nose  north,  with  ground 
power  on  and  system  energized. 

(e)  Recheck  system  using  GSE. 

7.1.2  Takeoff  and  Climb  10-15K  feet,  maintain  level  flight  at  3  subsonic 

speeds . 

(a)  Prior  to  takeoff  perform  crew  station  checks  of  fire  warning 
and  fall  caution  lights  and  note  time  of  test  switch  operation. 

(b)  After  landing  connect  GSE,  check  system  and  obtain  data. 


90 


7.1.3  Subsonic  climb  to  max  altitude  and  crulae. 


(a)  Prior  to  takeoff  perform  crew  station  checks  of  fire  warning 
and  fall  caution  lights  and  note  time  of  teat  switch  operation. 

(b)  Dive  supersonic  for  5  seconds  with  sun  behind  aircraft. 

(c)  After  landing  connect  GSE,  check  system  and  obtain  data. 

7.1. A  Supersonic  climb,  5  minute  run  at  high  speed  and  max  power. 

(a)  Prior  to  takeoff  perform  crew  station  checks  of  fire  warning 
and  fail  caution  light  test  switches  and  note  time  of  test 
switch  operation. 

(b)  After  landing  connect  GSE,  check  system  and  obtain  data. 

7.2  Service  experience  and  data  collection  concurrent  with  other  flight 

testing. 

(a)  Perform  crew  station  checks  of  fire  warning  and  fail  caution  light 

and  note  time  of  test  switch  operation. 

(d)  After  flight  connect  GSE,  check  system  and  obtain  data. 
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7.3  Data  Collection 


1 


7.3.1  The  following  date  is  required  from  eech  flight. 

<a)  Air  Speed 

(b)  Altitude 

(c)  Mach  Number 

(d)  Outside  Air  Temperature 

(e)  Voice 

(f)  Time 

(g)  Weather  Conditions 

(h)  Afterburner  Operation  Time. 

(1)  Ambient  temp  at  each  UV  fire  detector  location. 

Data  collection  via  voice-  recordings  and  transcribed  are  acceptable  and 

ahould  be  made  available  in  the  same  time  frame  as  print  outs  obtained 

from  the  CSE.  The  time  at  which  the  fire  warning  switch  is  energized  is 

used  to  relate  to  any  fire  indication  and/or  to  data  stored  in  the  memory 

system  of  the  on-board  computer  control  units  during  flight.  Data  to  be 
selected  to  actual  flight  identification. 

7.3.2  The  recordings  and  associated  hard  copy  printout  obtained  from 
the  GSE  should  be  attached  to  a  copy  of  the  above  data  collection 
record  and  transmitted  to  the  Contractor  for  evaluation.  The  above 
flight  test  data  should  be  made  available  for  the  dedicated  flights 
and  other  service  data  experience  for  a  minimum  period  of  three 
months. 
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onifiiinaietei 


8.0  Engines  fro*  left  snd  right  hand  sides  should  be  removed,  detectors 
Inspected,  engine  replaced,  and  system  checked  using  the  GSE. 

9.0  Certification 

9.1  Hazard  Analysis  -  FZM-12-14101 

9.2  Electromagnetic  Compatibility  Test  Plan  -  The  electromagnetic 
compatibility  testing  will  be  accomplished  per  Electromagnetic  Teat  Plan 
F8-111A  No.  1  Electromagnetic  Interference  Safety-of -Flight  Acceptance  Test 
Procedure  for  Advanced  Aircraft  Fire  Detection  System,  FZE-12-6099. 

10-0  Operation  and  Maintenance  Instructions  -  Operation  and  Maintenance  Instruc¬ 
tions  are  contained  in  the  subcontractor,  Craviner ,  Manual  identified  as  MM055. 
11.0  Associated  Drawing  List 
11.1  Aircraft  Installation  Drawings  (New) 

Drawing  Title 

System  A  Instl  -  Advanced  Aircraft  Fire 
Detection  System 

System  B  Instl  -  Advanced  Aircraft 
Fire  Detection  System 

Advanced  Aircraft  Fire  Detection 
System 

Wiring  Diagram  -  Advanced  UV  Fire 
Detect  System 

Control  Unit  Instl  -  Ultra  Violet 
Advanced  Fire  Detect  System 

Lower  Firewall  BHD-UV  Advanced  Fire 
Detect,  Rework  of 

Control  Unit  Inatl  -  Ultra  Violet 
Advanced  Fire  Detect  System 


t 


Number 


12FTP2109 


12FTP2111 


12FTP2110 


12FTD244 


12FTE325 


12FTE326 


12FTE327 


11.2  UV  Fit* 


Detection  Syetem  Equipment 


(Creviner) 


Neme 


Subcont rector 
Pert  Number 


Computer  Control  Unit.  Syetem  A 

Computer  Control  Unit.  Syetem  * 

S”“*  * 

5  ,  »,.«•>  tOMl  »..<>•  *»•'«  * 
Cr«  w.rnvria  «»«.  * 

Ground  Support  Equipment  (CSE) 


53813-203 

53813-204 

53521-012 

53522-Oil 

53813-202 

51659-062 
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FLIGHT  TRIALS  DATA  READOUTS 
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UU-NEAD  TEST  COtfLETE 


STMT  FUNCTIONAL  TEST 


JBDCwWUUWOrwuuuPwuuww*****  ■ 

MB8000800OB0>0Bi0000WOOO 
FUNCTIONAL  TEST  COflPLETE 
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RIGHT  ENG 
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FIRE  AT  -  II 
AREA  3 

FIRE  OUT  AT  -  II 
AREA  3 

(BACKGROUND  HOT  UAL  10) 

END  OF  DATA  ANALYSIS 


END  OF  ALL  TESTS 
SYSTEM  INTEGRITY 
CONFIRMED 

-REMOVE  PAPER- 


FIG.  1 
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STMT  CONTN.  UNIT  TESTS 
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SYSTEM  INTEGRITY 
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-REMOUE  PAPER- 
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CONTROL  UNIT  TESTS  COdPLETE 
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FIG.  4 


IOO 


!M4M 


^  .<  IS  s.&  1  jj 


.  -  i 


WTMWWVS.tvwv-.- - - - . 

IWEWI8l,S2!SS!222 

mmmmmmmmmm 

MMMNIMMMNINNiiMMM*1 


MMMfFNFFEt6iMMIFM»«iFfFF 


START  CONTROL  UNIT  TESTS 
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END  OF  DATA  ANALYSIS 


•>KAA  CCU  TEST  COMPLETE 


FIG.  5 


END  OF  ALL  TESTS 
SYSTEM  INTEGRITY 
CONFIRMED 
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GD/MAUIHEI  fifDS  MITO  TEST  MOTH 


SVSTEH  A 
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-REMOUE  PBPER- 


FIC.  6(cont'd) 
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APPENDIX  A- 3 


FLIGHT  TEST.  HEAT  TEMPERATURE  DATA 


ENGINEERING  FLIGHT 

TEST  REPORT 

A««Cft*r  T 

UAf| 

fuGHt  AlNCHt 

KB-111 1\ 

12  Hep  ttO 

3  I  Kunci v/Stokes 

Tf  IT  PLAN  NUMDt  H 

UNIAI 

tom  011  1  Ml  j  Duration  OK  TliOnT 

boa 

67-159 

1251  Lwi.  J  1.7  hr 

tTAKCOfr  CMO*»  »l'OMT  IuMUjICT  projSct  nummcm 

flO.OOO  lb _ |  ‘JV  Fire  Detector _ MMET  78-11 -1058S 


HuM^ote 

•Evaluate  UV  Fire  Detector  Uyutem  lueuted  in  engine  bays. 


COM  ICUMATIOM 


Cat  Kt4 


T|.*T  AND  COMMtNTi 

Profile  (KIAU,  MIL,  Much,  Time  (hr,  rain,  oec) 

Ali  is  Afterburner) 


Initialize  UV 

12. 

29. 

35 

Takeoff  (AB) 

12. 

50. 

1*5  - 

12, 

51. 

50 

Climb  to  26,000 

(ab: 

12. 

57, 

Ob  - 

12. 

58, 

58 

290/26 ,000/. 71 

13. 

Ul*. 

25  - 

13. 

•*5. 

30 

30,000/. 8  (AB) 

13. 

50, 

1*5 

30,000/1.0  (AB) 

13. 

51, 

1*5 

6UO/31.000/1.68 

(AB) 

13. 

53, 

55 

650/1*0,500/2.0  ■ 

-  2.15  (AB). 

13. 

55. 

15  - 

I*4 . 

00, 

12 

Landing 

I*. 

28 , 

30 

There  were  no  inflight  trips  of  the  UV  sensors. 

Temperature  data  ut  the  UV  locations  is  shown  on  the  attached  plots  and  printouts. 
Maximum  possible  error  is  ♦  9°F. 
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tmmuA  PA OS  BLIMWWT  niMD 


0T  MM,  junto,  path,  do,  o»«  Mil 
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12*  6:43  12i39«51  '  13*12*59  13*46:  6  14*18*16 


UV  FIRE  DETECTION  TEST  SIDE  FLIGHT  #  3 

FBIIIAUV  UV1803  80091213  27-0CT-68  ^  r 


12*’ 6*43  ;  12*39*5!  13*12*59  13*46*  7  14*10*15 

; : ;  1 : : '  ■  TINE  :  HRMNSC  ■ 


DETECTION  TEST  SIDE  FLIGHT  #  3 

UV1003  60001213  27-OCT-80 


Tint  HRHNSC 


ULTRA  VIOLET  ADVANCED  PIRE  DETECTION  SYSTEM 


Contract  No.  F3361S-77C-2029 
(GD  P.O.  No.  <29889  of  18  July  78) 


Report  of  Field  Investigation  and  Associated  work  at  McLellan  AFB , 
Sacramento,  26  Slay  81  -  02  Ju.^e  81. 


Purpose 

To  investigate  intermittent  start-up  failure  of  tha  U.V.  Fire  Detection 
System  installed  on  an  F-lll  aircraft. 

To  investigate  deficiencies  in  operate  characteristics  of  GSE  Serial  001 
and/or  to  commission  GSE  Serial  002. 

Personnel 

R.J  .  Springer  -  General  Dynamics 
D.J.V.  Smith,  P.H.  Sheath  •  HTL/Graviner 


1.  Background 

During  flight  trials  it  had  been  reported  that  sometimes  initial  power 
up  on  the  aircraft  caused  System  B  (right  engine)  failure  lamp  to 
show.  On  a  2  day  visit  in  March  1981,  the  problem  had  not 
occurred  at  all  and  this  visit  was  arranged,  with  the  support  of 
additional  equipment,  to  investigate  the  problem  in  greater  depth. 

In  addition,  the  GSE  (S/N  001)  had  exhibited  incorrect  print  out 
characteristics.  Action  was  required  to  investigate  this  problem  and 
a  second  GSE  (S/N  002)  was  also  delivered  to  Sacramento. 

2.  Investigation  of  UV  Detection  System 

From  previous  reports,  it  was  apparent  that  the  systems  failure 
was  random  in  nature  and  that  it  would  be  useful  to  retain  data 
during  a  failure  event  for  subsequent  analysis.  A  14  channel  FM 
recorder  was  provided  by  HTL  together  with  s  digital  storage  scope 
for  analysis. 

The  recorder  was  connected  to  power  supply  lines,  UV  Head  and  emitter 
lines  of  System  B  via  appropriate  voltage  reduction  circuits. 
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2.  Investigation  of  UV  Detection  Systems  (Continued) 


On  initial  aircraft  power  switch  on,  (26  May  81)  a  System  B 
fail  lamp  showed  and  the  whole  event  was  recorded. 

Analysis  showed  that  UV  Head  2  failed  to  strike  during  the  first 
auto  test  period  but  did  respond  on  subsequent  teat  periods. 

Heads  1  and  4  were  observed  to  fire  late  in  the  first  test  period 
and  then  correctly  in  subsequent  test  periods.  This  combination 
of  late  firings  was  (correctly)  interpreted  by  the  CCU  as  a  system 
failure  and  the  fall  light  was  displayed.  Subsequent  testing  showed 
that  this  mode  of  failure  oould  not  be  repeated'  unless  the  aircraft 
system  was  left  for  several  hours  between  "power  ups”. 

Although  flight  test  personnel  at  Sacramento  had  reported  failures 
on  system  B  only,  it  wes  established  by  similar  recording  and 
analysis  that  the  dual  heada  of  syatem  A  exhibited  the  tame  reluctance 
to  start  at  initial  power  on.  The  higher  level  of  redundancy  of 
system  A  however,  masked  the  effect  end  systm  A  (left  engine) 
fail  lights  did  not  show. 

Initial  thoughts  on  the  cause  of  failure  centered  around  the  possibility 
that  head  drive  voltages  might  not  be  established  quickly  enough  end 
that  cable  length  and  capacitive  effeats  might  starve  the  heads  of  the 
required  firing  voltages  at  initial  power-on. 

Head  2  on  syetem  A  wes  selected  for  further  examination  to  determine 
whether  sufficient  head  and  emitter  voltage  was  present  to  cause 
breakdown  and  excitation.  On  two  occasions  of  power-on,  voltages 
appeared  to  be  adequate  on  both  counts.  (Precise  figures  were  not 
available  on  site  because  of  calibration  inaccurraciee  of  the  rented 
equipment  but  these  were  determined  later  from  analysis  of  the  FM 
recorder  tapes)  Further  tests  were  made  to  determine  whether  the 
problem  was  in  the  heads  or  the  CCU  head  drive  circuits  and  it  was 
shown  that  the  head  drive  circuit;  were  capable  of  operation  with  even 
increased  cable  lengths  and  capacitance.  This  was  also  confirmed  on 
duplicate  tests  conducted  simultaneously  in  the  U.X. 

It  was  then  possible  to  Isolate  the  fault  as  being  either  the  photocells 
or  emitters  falling  to  strike  under  the  application  of  the  320  V  stimulus. 
During  the  work  in  March  81,  R09  on  the  heed  drive  Cards  had  bean 
removed  to  delete  a  possible  limiting  effect  on  head  drive  current.  These 
were  replaoed  in  order  to  provide  •  Source  imped  an  oe  for  monitoring  the 
current  drawn  at  successive  emitter  firing*.  It  was  shown  that  each 
head  firing  did  correspond  to  a  step  in  the  emitter  voltage  characteristic . 
However,  this  still  did  not  Isolate  the  cause,  it  being  possible  that 
through  current  limiting  on  the  head  drive  circuit,  the  first  heed  to 
fire  may  drop  the  emitter  line  voltage. 
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Investigation  of  UV  Detection  System*  (Continued) 


To  further  investigate  this  possibility,  s  heed  drive  card  (taken  from 
08B  001)  we*  modified  so  that  an  external  supply  could  be  used  to 
fire  emitters  only,  thus  isolating  the  effeots  of  head  drive  supply 
performance.  Subsequent  runs  showed  correlation  between  head 
firing  delay  times  and  steps  in  the  independent  emitter  drive  drouit 
voltage,  thus  a  dear  indication  that  emitters,  not  photocells,  were 
the  cause  of  delays. 

An  additional  check  on  the  installation  effects  waa  made  by  adding  a 
200'  cable  length  to  head  2  emitter  line  on  System  B .  This  did  not 
appear  to  cause  any  delayed  operation  of  head  2  emitter. 

Conclusions 

3.1  Tha  cause  of  System  B  fall  light  showing  during  tha  flight  test 
program  Is  shown  to  bs  the  reluctance  of  emitters  to  fire  after 
an  extended  off  period. 

The  phenomenon  hee  since  been  reproduced  in  laboratory  conditions 
by  keeping  emitters  in  light  tight  photographic  bags  overnight 
and  demonstrating  the  same  effect.  (There  is  however,  a 
difference  In  scale  in  that  the  slightest  amount  of  radiation  stimulus  - 
a  pinhole  in  the  beg  -  appears  to  ba  sufficient  to  eliminate  the  effect). 

3.2  A  previously  proposed  software  change  to  ignore  tha  results  from 
the  first  few  test  periods  is  not  now  recommended  u  a  solution 
to  the  problem.  During  these  investigations  emitter  firing 
reluctance  has  been  seen  to  persist  for  up  to  1}  minutes. 

3.3  The  continuation  of  flight  testing  is  proposed,  using  s  flight  deck 
software  reset  procedure  to  cancel  any  fall  light.  Longer  term 

the  effect  of  reluctant  emitters  may  be  solved,  for  instance,  by 
the  addition  of  a  spot  of  radioactive  paint. 

3.4  No  other  faulta  were  found  during  this  very  exhaustive  investi¬ 
gation  and  analysis  of  system  performance.  There  is  every 
reason  to  believe  that  the  system  will  now  continue  to  give 
reliable  in  flight  performance. 


APPENDIX  A- 5 


COCKPIT  RESET  MODIFICATION 


Uj&TRA  VIOLET  ADVANCED  FIRE  DETECTION  SYSTEM 
Contract  No.  F33615-77C-2029 


MODIFICATION  PROPOSAL 


1.  Objective 

To  provide  an  eaay  method  of  reset  for  the  UVAFDS  system  from 
the  pilot  station  without  the  necessity  to  access  the  CCU  in  the 
F-lll  Instrumentation  bay.  This  will  enable  the  cancellation  of 
any  teat  response  malfunction  at  power-up  and  hence  maximise  the 
value  of  continued  test  flying. 

2.  Method 

It  is  proposed  to  use  the  existing  fire  and  fault  test  buttons  at 
the  pilot  station  and  arrange  that  when  these  buttons  are  pressed 
in  a  p re-determined  sequence,  a  memory  reset  is  effected  in  the 
CCU. 


Programme  control  lines  exist,  running  into  the  CCU  via  the  GSE 
socket.  To  cause  a  new  programme  to  be  run,  these  lines  must 
be  set  appropriately  and  actioned  by  system  reset.  The  CCU  then 
searches  for  and  axscutaa  the  selected  routine. 

In  the  proposed  modification  the  fire  and  fault  test  push  buttons 
will  be  utilised  ee  follows: 


The  fsult  teat  button  acts  to  aalect  the  programme  required  but 
this  will  not  be  run  until  the  fire  test  button  is  also  pushed,  this 
acting  aa  a  resat  function.  Tha  fire  test  button  acts  as  a  resat 
oommand  but  only  if  the  fault  button  Is  also  pressed. 

With  no  programme  lines  selected,  the  system  automatically  assumes 
its  normal  rols  of  running  tha  fire  detection  programme. 


3.  Modifications  Required 


3.1 


3.2 


f 


cwu 

The  existing  CWU  will  be  replaced  by  a  modified  unit  prepared 
by  Qravlner.  The  replacement  la  easily  effected  on  the  aircraft 
but  tha  Internal  modifications  to  tha  CWU  are  rather  too  complex 
to  oonelder  on  site  modification  of  tha  existing  installed  unit. 

Aircraft  Wiring 

Two  additional  screened  wires  are  required  between  the  CCU 
and  CWU.  (2  wires  approximately  8'  long  each) 

These  wires  are  to  be  fitted  to  the  existing  CWU  flying  socket 
st  one  end  and  to  plugs  that  mats  with  tha  QSE  socket  of  the 
CCU  st  the  other  end. 
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3.3 


CCU  Logic  Card* 

An  additional  diode  la  to  be  added  to  each  of  the  3  logic 


cards  of  the  CCU.  This  involves  cutting  a  circuit  track, 
moving  a  wire  link,  fitting  the  diode  and  varnish  sealing. 
It  Is  proposed  that  this  work  is  done  by  McLelland  AFB 
Staff  under  the  supervision  of  HTL. 


4.  Reset  Procedure 

To  effect  a  reset  operation,  the  following  procedure  will  be  used. 

a)  Press  and  hold  down  the  FAIL  IND  TEST  button. 

This  will  cause  both  fail  lamps  to  alow. 

b)  Press  and  release  the  FIRE  DETECT  TEST  button. 

Both  fire  detect  fail  lights  will  extinguish. 

c)  Wait  approximately  3  seconds  with  FAIL  IND  TEST  button 
still  down. 

d)  Press  and  hold  down  the  FIRE  DETECT  TEST  button. 

e)  Release  the  FAIL  IND  TEST  button. 

L.  Engine  Fire  indication  will  show* in  approx.  1.5  seconds. 
R.  Engine  Fire  indication  will  show  in  approx.  6  seconds. 

f)  Release  FIRB  DETECT  TEST  push  button. 


Both  system  A  and  system  B  will  have  been  reset  by  the  above 
procedure  and  the  teat  buttons  resume  their  normal  functions. 
The  fact  that  normal  functions  are  resumed  can  be  confirmed  by 
the  usual  pre-flight  check. 


3.  GSE  Interaction 

The  modification  described  above  causes  no  change  in  operation 
of  the  GSE  and  requires  no  modification  of  the  GSE. 

A  minor  procedural  change  should  be  noted  that  before  cable  1 
from  the  GSE  can  be  attached  to  the  CCU ,  the  additional  flight 
connected  cable  to  that  socket  must  be  removed.  This  cable  may 
be  allowed  to  hang  loose  as  there  are  no  standing  voltages  on  the  pins. 


6.  Comment 

The  proposed  modification  allows  a  system  reset  operation  to  be 
performed  without  gaining  access  to  the  CCU  instrumentation  bay. 
Two  minor  disadvantages  are  identified  as  follows: 

6.1  The  addition  of  two  new  cables  could  possibly  affect  the  EMC 
approval.  However,  the  effects  are  thought  to  be  minimal, 
especially  with  the  screened  cable  reoommended. 
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6.2  The  modification  to  tha  CWU  involves  separating  switch 
contacts  that  are  currently  paralleled.  This  causes  a 
reduction  in  reliability  of  the  switch  contacts  but  is 
considered  entirely  acceptable. 


Dave  Smith 
23  June  81 
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